[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n
<\/span> <\/p>\n A path traversal attack aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with \u201cdot-dot-slash (..\/)\u201d sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.<\/span><\/p>\n <\/span><\/p>\n Two possible attack vectors were identified. The first attack vector is exploitable via the website. Here, a user is able to upload zip-archives via the File -> File transfer -> Upload function. Using this vector, only xml-, csv- and txt-files can be extracted. The second vector arises from the MO Connect feature. In this case the content of the imported zip-files is not checked and any compressed file-type will be extracted to an attacker-specified path. By this, it is possible to write xml-configuration files or to deploy tomcat war archives containing malicious code.<\/span><\/p>\n <\/span><\/p>\n <\/span><\/p>\n The most effective way to prevent file path traversal vulnerabilities is to avoid passing user-supplied input to the filesystem. The application should validate the archive filenames before processing it. Ideally, the validation should compare against a whitelist of permitted values. If that isn\u2019t possible for the required functionality, then the validation should verify that the input contains only permitted content, such as purely alphanumeric characters. After validating the supplied input, the application should append the input to the base directory and use a platform filesystem API to canonicalize the path. It should verify that the canonicalized path starts with the expected base directory.<\/span><\/p>\n
Advisory ID<\/strong>: usd-2020-0028<\/span>
CVE Number<\/strong>: CVE-2021-28042<\/span>
Affected Product<\/strong>: Mailoptimizer<\/span>
Affected Version<\/strong>: 4.3<\/span>
Vulnerability Type<\/strong>: Path Traversal<\/span>
Security Risk<\/strong>: High<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/www.deutschepost.de\/de\/m\/mailoptimizer.html<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\nDescription<\/h3>\n
Proof of Concept (PoC)<\/h3>\n
Fix<\/h3>\n
<\/h3>\n
References<\/h3>\n