CVE-2020-35598
📋 TL;DR
This directory traversal vulnerability in ACS Advanced Comment System 1.0 allows attackers to read arbitrary files on the server by manipulating the ACS_path parameter. It affects all installations of ACS Advanced Comment System 1.0 that are exposed to untrusted users. This appears to be a rediscovery of CVE-2009-4623.
💻 Affected Systems
- ACS Advanced Comment System
📦 What is this software?
Advanced Comment System by Advanced Comment System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like configuration files, password files, or database credentials, potentially leading to full system takeover.
Likely Case
Information disclosure of sensitive server files, potentially exposing credentials, configuration data, or other sensitive information.
If Mitigated
Limited impact with proper file permissions and web server configuration preventing access to sensitive directories.
🎯 Exploit Status
Exploitation requires no authentication and uses simple directory traversal sequences. The vulnerability is well-documented in security disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch exists. Consider removing or replacing the software entirely.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter directory traversal sequences in the ACS_path parameter
Modify advanced_component_system/index.php to validate ACS_path parameter against traversal patterns
Web Server Restriction
allConfigure web server to restrict access to parent directories
For Apache: Set 'AllowOverride None' in directory configuration
For Nginx: Use 'deny all' in location blocks for sensitive directories
🧯 If You Can't Patch
- Remove ACS Advanced Comment System from production environments
- Implement network segmentation and restrict access to affected systems
🔍 How to Verify
Check if Vulnerable:
Test by accessing the vulnerable URL with traversal sequences: http://target/advanced_component_system/index.php?ACS_path=../../../etc/passwdCheck Version:
Check the software version in the ACS installation directory or configuration filesVerify Fix Applied:
Attempt the same traversal attack after implementing workarounds to confirm access is blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '..%2f' or '../' in ACS_path parameter
- Unusual file access patterns from web server process
Network Indicators:
- HTTP GET requests with directory traversal sequences in query parameters
SIEM Query:
source="web_server_logs" AND (uri="*..%2f*" OR uri="*../*") AND uri="*ACS_path=*"