CVE-2020-10366
📋 TL;DR
LogicalDoc before version 8.3.3 contains a directory traversal vulnerability in the /servlet.gupld endpoint. This allows attackers to read arbitrary files on the server by manipulating file paths. All LogicalDoc installations running affected versions are vulnerable.
💻 Affected Systems
- LogicalDoc
📦 What is this software?
Logicaldoc by Logicaldoc
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like configuration files, password hashes, or SSH keys, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive documents stored in LogicalDoc, exposure of system configuration files, and potential credential harvesting.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only exposing non-sensitive files.
🎯 Exploit Status
Directory traversal vulnerabilities are typically easy to exploit with simple HTTP requests. Public advisories include technical details that facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.3
Vendor Advisory: https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt
Restart Required: Yes
Instructions:
1. Backup your LogicalDoc installation and database. 2. Download LogicalDoc 8.3.3 or later from the official source. 3. Follow the LogicalDoc upgrade documentation to apply the update. 4. Restart the LogicalDoc service.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock directory traversal patterns in requests to /servlet.gupld
WAF-specific configuration to block requests containing '../' or similar path traversal sequences
Access Restriction
linuxRestrict access to the vulnerable endpoint using network controls
iptables -A INPUT -p tcp --dport 8080 -m string --string "/servlet.gupld" --algo bm -j DROP
Similar rules for other firewall systems
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LogicalDoc instances from sensitive systems
- Deploy a web application firewall with rules to detect and block directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check if accessing http://[logicaldoc-host]/servlet.gupld?file=../../../../etc/passwd returns system files (test in non-production environment only)Check Version:
Check the LogicalDoc admin interface or version.txt file in the installation directoryVerify Fix Applied:
After patching, attempt the same directory traversal test and verify it fails or returns an error📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /servlet.gupld containing '../' sequences
- Unusual file access patterns from web server logs
Network Indicators:
- HTTP GET requests with path traversal sequences in parameters
- Multiple failed attempts followed by successful file reads
SIEM Query:
source="web_logs" AND uri_path="/servlet.gupld" AND (uri_query="*../*" OR uri_query="*..\\*" OR uri_query="*%2e%2e%2f*")🔗 References
- https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt
- https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities
- https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt
- https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities
