External Path Traversal in Datiphy Data Management Center

Executive Summary

This vulnerability is an External Control of File Name or Path issue in the upload API endpoint of Datiphy Data Management Center versions 8.3.0 through 8.5.1. A remote attacker can exploit this by using relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor file uploads to the Datiphy Data Management Center API endpoint for unusual file paths containing relative or absolute path sequences (e.g., ../ or /etc/passwd). Check server logs for unexpected file writes outside the intended upload directory. Inspect network traffic for requests to the upload API with suspicious payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could overwrite critical system files, execute malicious code, or gain unauthorized access to sensitive data by placing files in unintended locations. This could lead to system compromise, data breaches, or denial of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Organizations may face legal penalties, loss of compliance certifications, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Datiphy Data Management Center to a version beyond v8.5.1 to address the file upload path vulnerability. Disable or restrict access to the upload API endpoint if not essential. Implement strict input validation for file upload paths to prevent directory traversal attempts.

Useful 0 Not Useful 0