Path Traversal in WebDyne PSGI API Route

Executive Summary

WebDyne versions 3.007 to 3.021 have a path traversal flaw in the PSGI API route fallback. When a request doesn't match a file, the system retries it as an API route while preserving path segments like .. This allows requests like /../private to bypass document root checks. Attackers can then execute embedded Perl in any readable .psp file, even those outside the intended directory.

Useful 0 Not Useful 0

Detection Guidance

Check for WebDyne versions between 3.007 and 3.021 by inspecting installed packages or server headers. Look for unusual .psp file access patterns or API route fallback attempts in logs. Test with crafted requests like /../private to see if .psp files outside the document root are executed.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious Perl code on your server. This might allow unauthorized access to sensitive data, system compromise, or further network infiltration. The impact depends on what .psp files the server can read and what permissions they have.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements or HIPAA's security rules. Organizations might face compliance violations, fines, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade WebDyne to version 3.022 or later immediately. Disable the PSGI API route fallback if not needed. Restrict file uploads to prevent .psp file uploads outside the document root. Review server logs for signs of exploitation attempts.

Useful 0 Not Useful 0