Authenticated Path Traversal in Subrion CMS 4.2.1

Executive Summary

This is a path traversal vulnerability in Intelliants Subrion CMS version 4.2.1 or earlier. An authenticated administrator can exploit it by sending a specially crafted file path to the file deletion endpoint in the admin panel. The endpoint directly passes this path to the unlink() function without proper sanitization or path validation, allowing the attacker to delete arbitrary files on the server, including sensitive system files outside the web root.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions in server logs, especially under the admin panel file deletion endpoint. Look for paths containing '..' or unusual file operations in access logs.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator of a vulnerable Subrion CMS instance, an attacker with admin access could delete critical system files, causing server instability or complete failure. This could lead to data loss, service disruption, or enable further attacks by removing security controls or logs. Even if you are not an admin, if an attacker gains admin privileges through other means, they could exploit this to cause significant damage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion, potentially resulting in data breaches or loss of protected health information. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding medical records. Exploiting this flaw could violate these regulations, leading to legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Subrion CMS to the latest patched version. Restrict admin panel access to trusted IPs. Monitor file system changes and disable the vulnerable endpoint if possible.

Useful 0 Not Useful 0