PT-2023-6213 · South River Technologies · Titan Sftp+1
Ron Bowes
·
Published
2023-10-16
·
Updated
2024-09-16
·
CVE-2023-45685
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
South River Technologies' Titan MFT and Titan SFTP servers (affected versions not specified)
Description
The issue is related to insufficient path validation when extracting a zip archive, allowing an authenticated attacker to write a file to any location on the filesystem via path traversal. This can be exploited by a remote attacker to record files in arbitrary locations of the file system.
Recommendations
For South River Technologies' Titan MFT and Titan SFTP servers, consider restricting access to the zip archive extraction functionality until a patch is available.
As a temporary workaround, consider disabling the zip archive extraction feature to minimize the risk of exploitation.
Avoid using the vulnerable path validation mechanism in the affected servers until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Incorrect Default Permissions
Session Fixation
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Titan Mft
Titan Sftp