Path Traversal in Moment.js moment.locale

This repository is a small Node.js/Express vulnerability lab for CVE-2022-24785 in Moment.js, not a standalone one-shot exploit script. The core logic is in app.js, which exposes a web interface for uploading files and then invoking moment.locale() with attacker-controlled localeId values via /moment. Because the project pins moment to 2.27.0, the vulnerable locale-loading behavior can be abused with traversal strings such as ../../../uploads/test1.js so that Moment/Node require() loads files outside the intended locale directory. Since uploaded files are stored in uploads/ with original filenames and are also browsable via /uploads, the application intentionally creates the prerequisite for turning path traversal/LFI into server-side JavaScript execution. Repository structure: app.js is the main server entry point; assets/html/home.html explains the lab and attack flow; assets/html/upload.html provides file upload capability; assets/html/moment.html generates example exploit URLs and demonstrates locale manipulation; uploads/ contains sample payload files. test1.js and test2.js are benign execution proofs that log to the Node console. test3.js is the notable payload: it spawns /bin/sh and connects to 10.0.0.2:443, providing a reverse shell if executed. test4.txt demonstrates that Node can require and execute JavaScript content even from a non-.js extension in this context. Main exploit capability: remote web-triggered path traversal into Moment.js locale loading, leading to arbitrary local file require() and practical RCE when the attacker can place a JavaScript file on disk. The exploit is operational rather than merely demonstrative because the repository includes working payload examples and an end-to-end delivery path (/upload -> /moment).

This repository is a proof-of-concept (PoC) Node.js Express application designed to demonstrate and exploit the Moment.js path traversal vulnerability (CVE-2022-24785). The main application (app.js) allows users to upload arbitrary files to the 'uploads/' directory and then access them. The /moment endpoint is vulnerable to path traversal via the 'localeId' parameter, which is passed to Moment.js's locale loading functionality. By uploading a malicious JavaScript file (such as uploads/test3.js, which contains a reverse shell payload) and then accessing /moment?localeId=../../../uploads/test3.js, an attacker can trigger Node.js to 'require' and execute the uploaded file, leading to arbitrary code execution. The repository includes several example payloads, including a reverse shell. The exploit is network-based, requiring access to the vulnerable web application. The structure is typical for a Node.js Express app, with static assets, HTML templates, and a main server file. The exploit demonstrates the real-world impact of the Moment.js vulnerability and provides a working example for security testing and research.