Description
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
risesoft-y9 Digital-Infrastructure
Default version status: unaffected
9.6.5 to ≤ 9.6.11affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/digital-infrastructure-filemanager-path-traversal-rw ↗
- https://github.com/risesoft-y9/Digital-Infrastructure/blob/v9.6.11/y9-digitalbase-module/y9-module-filemanager/risenet-y9boot-webapp-filemanager/src/main/java/net/risesoft/y9public/controller/Y9FileController.java#L136-L166 ↗
- https://www.vulncheck.com/advisories/digital-infrastructure-9.6.5-through-9.6.11-path-traversal-via-filemanager-retrievefilestream ↗