CVE-2020-25623
📋 TL;DR
This CVE describes a directory traversal vulnerability in Erlang/OTP's inets httpd application. An attacker can send specially crafted HTTP requests to read arbitrary files from the server's filesystem. Systems running vulnerable versions of Erlang/OTP with httpd enabled are affected.
💻 Affected Systems
- Erlang/OTP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files, or database credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive files containing application secrets, configuration data, or user information, leading to data breach and potential privilege escalation.
If Mitigated
Limited file access restricted by proper file permissions and network segmentation, with minimal impact due to defense-in-depth controls.
🎯 Exploit Status
Directory traversal vulnerabilities are well-understood and easily weaponized. The vulnerability requires httpd to be accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.3.4.6 or 23.1
Vendor Advisory: https://www.erlang.org/news
Restart Required: Yes
Instructions:
1. Upgrade Erlang/OTP to version 22.3.4.6 or 23.1 or later. 2. Download from erlang.org/downloads or GitHub releases. 3. Install the updated version. 4. Restart all Erlang applications using inets httpd.
🔧 Temporary Workarounds
Disable httpd or restrict access
allDisable the inets httpd application if not needed, or restrict network access to only trusted sources.
Modify Erlang application configuration to disable httpd or configure firewall rules to restrict access
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems from untrusted networks
- Apply strict file system permissions to limit accessible files and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Erlang/OTP version and verify if inets httpd is enabled in application configuration.Check Version:
erl -eval 'erlang:display(erlang:system_info(otp_release)), halt().'Verify Fix Applied:
Verify Erlang/OTP version is 22.3.4.6 or 23.1 or later, and test with directory traversal attempts.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing directory traversal sequences (../, ..\)
- Access to unexpected file paths in httpd logs
Network Indicators:
- HTTP requests with encoded directory traversal payloads
- Unusual file access patterns from single IPs
SIEM Query:
http.url:*%2e%2e%2f* OR http.url:*..%2f* OR http.uri:*../*