Path Traversal in Flowring Agentflow

Executive Summary

This is a Path Traversal vulnerability in Flowring Agentflow 4.0 before 2023/03/24. It allows remote authenticated users to write files to arbitrary locations outside the intended upload directory by manipulating the path parameter in the /WebAgenda/download/uploadFile.jsp API endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized file writes outside the intended upload directory in Flowring Agentflow 4.0 before 2023/03/24. Inspect server logs for suspicious path traversal attempts in the /WebAgenda/download/uploadFile.jsp endpoint. Look for requests containing path parameters with directory traversal sequences like ../.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to overwrite critical system files, execute malicious code, or disrupt services by placing files in unintended directories. This could lead to system compromise or data loss if the attacker gains elevated privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches or unauthorized system changes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Flowring Agentflow to version 2023/03/24 or later. If an update is not possible, restrict access to the /WebAgenda/download/uploadFile.jsp endpoint and implement strict input validation for path parameters to prevent directory traversal.

Useful 0 Not Useful 0