ZDI-24-099: Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a registration mechanism that can be used to create a new user with a sufficient privilege level. The specific flaw exists within the getFileContentAsString method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a registration mechanism that can be used to create a new user with a sufficient privilege level. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-22530.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-099?
The severity of ZDI-24-099 is classified as high due to the potential for sensitive information disclosure.
How do I fix ZDI-24-099?
To fix ZDI-24-099, ensure that you update Allegra to the latest version that addresses this vulnerability.
What kind of information can be disclosed by exploiting ZDI-24-099?
Exploiting ZDI-24-099 can lead to the disclosure of sensitive configuration details and user information.
Who is affected by ZDI-24-099?
Any installations of Allegra that have the registration mechanism enabled are affected by ZDI-24-099.
Is authentication required to exploit ZDI-24-099?
Yes, authentication is required to exploit ZDI-24-099, but the registration mechanism can be used to create a user.