Executive Summary

This vulnerability in Rapid7 Appspider Pro versions below 7.5.021 is a broken access control issue in the application's configuration file loading mechanism. It allows an attacker to place files in directories belonging to other users or projects. Since the application loads configuration files in alphabetical order, an attacker can add custom configuration files that override or change the settings of the original configuration files, leading to a security risk. The root cause is improper directory access management.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a standard user to modify or override configuration settings of other users or projects by placing malicious configuration files. This can lead to unauthorized changes in application behavior or security settings, potentially compromising the integrity of the application environment.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Rapid7 Appspider Pro to version 7.5.021 or later, as this version remediates the broken access control vulnerability in the configuration file loading mechanism.

Useful 0 Not Useful 0