CVE-2022-51022: YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YiShaAdminto a version that resolves this vulnerability.Patch 025b062
Event History
Frequently Asked Questions
Which deployments are affected?
YiShaAdmin versions 2.2 through 3.1 are affected. The issue is fixed in commit 025b062.
What access does an attacker need?
An attacker can target the endpoint remotely with crafted GET requests. No authentication, prior privileges, or user interaction are required.
How can defenders look for exploitation attempts?
Review requests to /admin/File/DownloadFile for filePath values containing directory-traversal sequences and for use of the delete parameter. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.