DbGate Path Traversal via jslid Parameter Allows File Access

Executive Summary

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.

Useful 0 Not Useful 0

Impact Analysis

Authenticated users can read and write arbitrary files on the system hosting DbGate. Sensitive files, including encrypted database credentials, may be accessed or modified, leading to potential data breaches or unauthorized access to databases.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update DbGate to the latest version that patches the jslid parameter validation issue. Restrict file:// scheme access in application configurations. Review and audit file permissions for sensitive files like database credentials. Monitor for unauthorized file access attempts.

Useful 0 Not Useful 0