PT-2014-4914 · Wd · Wd Arkeia Virtual Appliance

Published 2014-04-28 · Updated 2020-02-24 · CVE-2014-2846

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WD Arkeia virtual appliance (AVA) versions prior to 10.2.9

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files and execute arbitrary PHP code. This is achieved by manipulating the lang Cookie parameter with a /././ (dot dot dot slash dot slash) sequence, as demonstrated by a request to "login/doLogin" API endpoint.

Recommendations For versions prior to 10.2.9, update to version 10.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the login/doLogin API endpoint to minimize the risk of exploitation. Avoid using the lang Cookie parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-2846

Affected Products

Wd Arkeia Virtual Appliance

References · 5

• 🔥 http://seclists.org/fulldisclosure/2014/Apr/257 · Exploit
• 🔥 https://exploit-db.com/exploits/33005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2846 · Security Note
• http://securityfocus.com/archive/1/531910/100/0/threaded · Note
• http://wiki.arkeia.com/index.php/Path_Traversal_Remote_Code_Execution · Note