CVE-2021-48015: JeeWMS Path Traversal via showOrDownByurl.do
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker can exploit it without authentication or user interaction by sending a crafted GET request to the affected endpoint.
What access does exploitation provide?
The issue allows reading arbitrary files accessible to the JeeWMS application through path-traversal sequences supplied in the dbPath parameter. The reported impact is confidentiality loss; integrity and availability impacts are not indicated.
Which deployments are affected?
JeeWMS versions before commit 0a610e8 are affected. The vulnerable request path bypasses AuthInterceptor, so protections relying on that interceptor do not prevent unauthenticated access to this endpoint.
How can defenders look for exploitation attempts?
Review GET request logs for /systemController/showOrDownByurl.do, especially requests whose dbPath parameter contains ../ path-traversal sequences. Exploitation evidence was first observed on 2023-10-17.