Executive Summary

This vulnerability is a path traversal issue in the Creative Ad Agent SDK server, specifically in the file server/sdk-server.ts component. It occurs because the server accepts user-controlled route parameters without properly validating them, allowing an attacker to manipulate the argument req.params to traverse directories on the server's filesystem.

By exploiting this flaw, an attacker can craft requests with encoded traversal sequences (such as %2e%2e/) to access files outside the intended directory, including sensitive files on the host system like /etc/hosts.

The vulnerability affects the /images/:sessionId?/:filename endpoint and can be exploited remotely without authentication. The issue was confirmed in commit 751b9e5 and a patch has been released under commit 3d255865a957f3740b8724dd914502c0f44d4970.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with network access to read arbitrary files on the server hosting the Creative Ad Agent SDK. This could lead to exposure of sensitive information stored on the server, including configuration files, credentials, or other private data.

Since the exploit is remote and does not require authentication, it increases the risk of unauthorized data disclosure and potential further attacks leveraging the accessed information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the path traversal issue on the affected endpoint /images/:sessionId?/:filename by sending specially crafted requests containing encoded traversal sequences such as %2e%2e/.

A practical detection method is to use curl with the --path-as-is option to request files outside the intended directory, for example, requesting sensitive files like /etc/hosts to verify if the server improperly allows access.

• curl --path-as-is http://<target-server>/images/anysession/%2e%2e/%2e%2e/%2e%2e/etc/hosts

If the server responds with the contents of the requested file, it confirms the presence of the path traversal vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to apply the patch identified by commit 3d255865a957f3740b8724dd914502c0f44d4970, which addresses this path traversal vulnerability.

Until the patch is applied, restrict network access to the vulnerable service to trusted users only, and monitor for suspicious requests containing encoded traversal sequences.

Additionally, validate and sanitize all user-supplied path parameters to ensure they do not contain traversal characters or sequences.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a path traversal issue allowing remote attackers to access arbitrary files on the server, including potentially sensitive system files.

Such unauthorized access to files could lead to exposure of sensitive or personal data, which may impact compliance with data protection regulations like GDPR or HIPAA if personal or protected health information is stored or accessible on the affected system.

However, the provided information does not specify whether personal data or regulated information is stored or exposed by this vulnerability, nor does it detail any direct compliance impact.

The recommended mitigation is to apply the patch to fix the vulnerability, which would help maintain compliance by preventing unauthorized data access.

Useful 0 Not Useful 0