Path Traversal in WebDyne via Malicious PSP File Upload

Executive Summary

This vulnerability affects WebDyne versions from 2.031 before 3.022 for Perl. It allows files with .psp anywhere in the name to be executed as Perl pages due to a flawed regex pattern (WEBDYNE_PSP_EXT_RE) that lacks an end anchor. Attackers can upload files like report.psp.pdf and execute embedded Perl code by requesting them.

Useful 0 Not Useful 0

Detection Guidance

Check for files with .psp anywhere in their name, especially in upload directories. Search for files matching patterns like *.psp* or report.psp.pdf. Review WebDyne configuration for WEBDYNE_PSP_EXT_RE settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious file with a .psp extension embedded in the name and trick the server into executing it as a Perl script. This could lead to remote code execution, data theft, or unauthorized system access depending on the server's permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by allowing attackers to access or manipulate protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade WebDyne to version 3.022 or later. Modify upload validation to reject files with .psp anywhere in the name. Add end anchors to WEBDYNE_PSP_EXT_RE to prevent partial matches.

Useful 0 Not Useful 0