Path Traversal in Nozomi Networks Appliance Web Interface

Executive Summary

This is a path traversal vulnerability in the Offline archives feature of the local web interface in Arc software. It allows a local user with admin credentials to submit an archive name with path traversal sequences, which can delete arbitrary files accessible to the Arc process running with admin privileges.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file deletions or suspicious archive names in Arc's offline archives functionality. Review Arc's logs for administrative web interface access attempts with path traversal sequences like '../'. Check for Arc process activity involving file deletions outside its expected directories.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could delete critical system files, disrupt operations, or cause data loss. Since Arc runs with admin privileges, the impact includes potential system compromise or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized file deletion on systems running affected Arc versions. Administrative privileges of the Arc process mean sensitive data or system files could be compromised, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Arc to version 2.7.0 or later. Review and rotate all administrative web interface credentials. If exposure to untrusted users is suspected, relaunch Arc's local web server to invalidate potential sessions.

Useful 0 Not Useful 0