Path Traversal in Campbell Scientific CSI Web Server and RTMC
The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.
Path Traversal in Campbell Scientific CSI Web Server and RTMC
The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.
Campbell Scientific recommends users to update to the version.
For user of CSI Web Server update to the most recent CSI Web Server 1.x patch https://www.campbellsci.com/downloads/csi-web-server-patch
For users of RTMC Pro 5 update to the most recent RTMC Pro 5.x patch https://www.campbellsci.com/downloads/rtmc-pro-5-patch
For users of RTMC Pro 4 update to the most recent RTMC Pro 4.x patch https://www.campbellsci.com/downloads/rtmc-pro-patch .
Contact Campbell Scientific https://www.campbellsci.com/contact for more details.
Configurations
Workarounds
Exploits
Credits
finder
Patrick K. Sheehan, Grant Hume, and Donald Macary reported these vulnerabilities to CISA.
The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given expression. A specially crafted expression can lead to a path traversal vulnerability. This command combined with a specially crafted expression allows anonymous, unauthenticated access (allowed by default) by an attacker to files and directories outside of the webserver root directory they should be restricted to.