CVE-2022-41607

ETIC RAS 4.5.0 and earlier API directory traversal vulnerability

• CVSS 7.5
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Remote

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vulnerable to directory traversal through several different methods. This could allow an attacker to read sensitive files from the server, including SSH private keys, passwords, scripts, python objects, database files, and more.

CVE

CVE-2022-41607

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

7.5

Published

2022-11-10

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update ETIC Telecom RAS to version 4.5.1 or higher.

import os
from flask import Flask, request, send_file

app = Flask(__name__)

@app.route('/api/get_file', methods=['GET'])
def get_file():
    requested_file = request.args.get('file')
    
    file_path = os.path.join('/path/to/files', requested_file)

    return send_file(file_path)

if __name__ == '__main__':
    app.run()

import os
from flask import Flask, request, send_file, abort

app = Flask(__name__)

ALLOWED_DIRECTORY = '/path/to/files'

def file_path(requested_file):
    path = os.path.normpath(requested_file)
    if path.startswith('..') or not path.startswith(ALLOWED_DIRECTORY):
        return None
    return os.path.join(ALLOWED_DIRECTORY, path)

@app.route('/api/get_file', methods=['GET'])
def get_file():
    requested_file = request.args.get('file')
    
    if not requested_file:
        return abort(400, description="File parameter is required")
    
    file_path = file_path(requested_file)
    
    if not file_path or not os.path.isfile(file_path):
        return abort(404, description="File not found")
    
    return send_file(file_path)

if __name__ == '__main__':
    app.run(debug=False)

@misc{vaitp:cve202241607,
  title        = {{ETIC RAS 4.5.0 and earlier API directory traversal vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-41607},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-41607/}}
}