Path Traversal in INDOTALENT WHMS Before 10.20261109

Executive Summary

This vulnerability is a path traversal flaw in INDOTALENT WHMS before version 10.20261109. It allows authenticated users to read arbitrary files on the server by manipulating the documentName and imageName parameters in requests to GetDocument or GetImage endpoints. The system uses Path.Combine without proper containment checks, enabling attackers to traverse directories and access sensitive files like appsettings.json.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual file access patterns in logs, especially for requests to /FileDocument/GetDocument or /FileImage/GetImage endpoints with traversal sequences like ../ in parameters. Monitor for authenticated users attempting to read sensitive files such as appsettings.json.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive configuration files, database credentials, or other confidential data stored on the server. Since self-registration is possible, even unauthenticated users might gain access. This could lead to data breaches, system compromise, or further attacks within the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict protection of personal data, while HIPAA requires safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade INDOTALENT WHMS to version 10.20261109 or later. If immediate upgrade is not possible, restrict access to the vulnerable endpoints, implement strict input validation for documentName and imageName parameters, and monitor for suspicious file access attempts.

Useful 0 Not Useful 0