Executive Summary

This vulnerability exists in Warehouse Management System 1.2 where an authenticated user can delete arbitrary files on the server. The /goods/deleteGoods endpoint takes a user-controlled parameter called goodsimg, which is concatenated directly with the server's UPLOAD_PATH and passed to the File.delete() function without any validation. This allows a remote authenticated attacker to use directory traversal payloads to delete files outside the intended directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with authentication to delete arbitrary files on the server, potentially leading to loss of important data, disruption of service, or compromising the integrity of the system by removing critical files.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers to delete arbitrary files on the server, including system configuration, application files, uploaded data, and logs. This can lead to denial of service or complete application failure, potentially impacting the integrity and availability of sensitive data. Such impacts could result in non-compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and availability. However, specific compliance implications are not detailed in the provided resources. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the /goods/deleteGoods endpoint containing directory traversal payloads in the goodsimg parameter, such as sequences like '../'. A proof of concept involves sending crafted POST requests with goodsimg values like '../a.txt' or '../../../../test.txt' to check if arbitrary files can be deleted. Network monitoring tools or web application firewalls can be configured to log or block such requests. Additionally, inspecting server logs for unexpected file deletions or errors related to file access may help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include normalizing file paths and blocking traversal sequences such as '..' in the goodsimg parameter, rejecting absolute paths, enforcing file deletion only within a predefined whitelist directory, validating that the file to be deleted is genuinely associated with the goods entry, and using server-side file ID mapping instead of accepting direct file paths from user input. [1]

Useful 0 Not Useful 0