Executive Summary

This vulnerability exists in Wertheim SafeController Software version 6.15.8328.28014. It is a path traversal flaw in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The software constructs file paths using input controlled by an attacker without properly validating it. As a result, an authenticated attacker with any role or permission level can manipulate the input to traverse outside the intended document directory and download arbitrary files that the application can access.

These files can include sensitive application log files and application binaries, which may contain confidential or critical information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to access sensitive files on the server that they should not normally be able to reach. This could lead to exposure of confidential information contained in log files or application binaries.

Such unauthorized access can compromise the security and integrity of the system, potentially enabling further attacks or data breaches.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated attacker to download arbitrary files, including application log files containing sensitive information. This exposure of sensitive data could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Since the vulnerability enables unauthorized access to sensitive files, it undermines the confidentiality and integrity principles mandated by these standards, potentially resulting in data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability allows an authenticated attacker to perform path traversal via the documentName parameter in the /safe/selfservice/openselfservicedocument endpoint.

Immediate mitigation steps include applying any available patches or updates provided by the vendor to fix this vulnerability.

Additionally, restrict access to the affected endpoint to trusted users only and monitor for unusual file access patterns.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability exists in the Wertheim SafeController Software version 6.15.8328.28014, specifically in the /safe/selfservice/openselfservicedocument endpoint where the documentName parameter is vulnerable to path traversal.

To detect this vulnerability on your system or network, you can attempt to access the endpoint with crafted requests that try to traverse directories by manipulating the documentName parameter.

• Use curl or similar HTTP clients to send requests attempting to access files outside the intended directory, for example:
• curl -v -u <username>:<password> "http://<target>/safe/selfservice/openselfservicedocument?documentName=../../../../etc/passwd"
• Replace ../../../../etc/passwd with other sensitive file paths relevant to your environment to check if arbitrary files can be downloaded.

Successful retrieval of files outside the intended document directory indicates the presence of the path traversal vulnerability.

Useful 0 Not Useful 0