Path Traversal in Brocade ASCG HTTP Service

Executive Summary

This is a path traversal vulnerability in Brocade ASCG versions before 3.5.0. It allows an unauthenticated attacker on the local network to send a manipulated API request that bypasses path restrictions. This can lead to arbitrary file read, file write, or file deletion operations on the affected system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual API requests targeting the Brocade ASCG service endpoint. Check for requests attempting path traversal sequences like '../' or '%2e%2e%2f' in parameters. Inspect logs for unauthorized file read, write, or delete operations on the system.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive files, modify or delete critical system files, or install malware. This could lead to data breaches, system instability, or unauthorized access to confidential information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face legal penalties, fines, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Brocade ASCG to version 3.5.0 or later. Block unauthorized access to the HTTP service component via network segmentation or firewall rules. Disable or restrict API endpoints if not required. Monitor for suspicious activity and apply vendor patches as soon as available.

Useful 0 Not Useful 0