CVE-2022-51025: Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=dbbackup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The endpoint requires authentication, but the disclosed hardcoded systemi account makes obtaining usable authentication effectively trivial. Exploitation can be performed remotely with a GET request and does not require user interaction.
What data could be exposed?
An attacker can use ../ sequences in the name parameter with type=db_backup to download arbitrary files readable by the affected WAPPLES system. The reported example retrieves /etc/passwd.
How can I determine whether exploitation has occurred?
Review logs for GET requests to /webapi/file/transfer, particularly requests using type=db_backup and name values containing ../ traversal sequences. Exploitation evidence was first observed on 2023-10-19.