ZDI-23-1496: A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability
This vulnerability allows remote attackers to read and delete arbitrary files on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The specific flaw exists within the FileMgmtExport class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to read and delete files in the context of the service account.
Other sources
This vulnerability allows remote attackers to read and delete arbitrary files on affected installations of A10 Thunder ADC. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.3. The following CVEs are assigned: CVE-2023-42130.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-1496?
The severity of ZDI-23-1496 is critical due to its potential impact on confidential file access.
How do I fix ZDI-23-1496?
To fix ZDI-23-1496, apply the latest security patch provided by A10 Networks for the Thunder ADC.
Who is affected by the ZDI-23-1496 vulnerability?
A10 Thunder ADC installations with improper file access controls are affected by the ZDI-23-1496 vulnerability.
Can ZDI-23-1496 be exploited without authentication?
No, the ZDI-23-1496 vulnerability requires authentication to exploit the file reading and deleting capabilities.
What impact does ZDI-23-1496 have on users?
ZDI-23-1496 allows authenticated attackers to read and delete arbitrary files, potentially compromising sensitive information.