Directory traversal vulnerability in jretest.html in WebConnect 6.5 and 6.4.4, and possibly earlier versions, allows remote attackers to read keys within arbitrary INI formatted files via "..//" sequences in the WCP_USER parameter.
WebConnect 6.5 and 6.4.4 (and potentially earlier versions) suffers from a critical directory traversal vulnerability allowing attackers to read sensitive configuration files. This flaw enables remote attackers to access confidential information, potentially leading to complete system compromise and data exfiltration.
Step 1: Payload Delivery: The attacker crafts a malicious HTTP request to jretest.html on the vulnerable WebConnect server. The request includes the WCP_USER parameter, which is designed to specify a user's configuration file.
Step 2: Directory Traversal Injection: Within the WCP_USER parameter, the attacker injects a directory traversal sequence, such as ..//..//..//. This sequence attempts to navigate up the directory structure.
Step 3: File Path Construction: The vulnerable script, jretest.html, concatenates the attacker-supplied WCP_USER value (including the directory traversal sequence) with a base path to construct the path to the target INI file.
Step 4: File Access: The script then attempts to read the contents of the file specified by the constructed path. Because of the directory traversal, the script reads a file outside of the intended directory.
Step 5: Data Exfiltration: The script returns the contents of the targeted INI file to the attacker, providing access to sensitive information such as usernames, passwords, API keys, or other configuration data.
The vulnerability stems from insufficient input validation in the jretest.html script when handling the WCP_USER parameter. Specifically, the script fails to properly sanitize user-supplied input, allowing attackers to inject directory traversal sequences (..//) into the parameter. This manipulation allows the attacker to navigate outside the intended directory and read arbitrary INI-formatted files, potentially including those containing sensitive credentials, API keys, or other confidential data. The root cause is a lack of proper input validation and path sanitization before accessing files on the server. The script directly uses the user-controlled WCP_USER parameter to construct file paths, making it vulnerable to directory traversal attacks. There's no authentication or authorization check to prevent unauthorized access to these files.