Path Traversal in EnergizeLab Station-Middleware Docker Images

Executive Summary

This vulnerability allows any registered low-privilege user to read arbitrary files on the server by providing a malicious file path. It affects EnergizeLab station-middleware Docker images versions 1.6.5 through 1.8.2 and can expose sensitive middleware files and server secrets.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file access attempts in logs by reviewing middleware server access logs for suspicious file path inputs. Inspect Docker images for versions 1.6.5 through 1.8.2 and verify if low-privilege accounts can read arbitrary files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access confidential data, steal credentials, or compromise the server by reading sensitive files. This could lead to data breaches, unauthorized system access, or further attacks on the infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access. It could result in legal penalties, loss of certification, and reputational damage for organizations handling sensitive personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade EnergizeLab station-middleware Docker images to version 1.8.3 or later to patch the vulnerability. Ensure no low-privilege accounts have unnecessary access to file paths.

Useful 0 Not Useful 0