CVE-2020-35736
📋 TL;DR
CVE-2020-35736 is an unauthenticated directory traversal vulnerability in GateOne web-based terminal emulator that allows attackers to download arbitrary files from the server. This affects GateOne version 1.1 due to improper use of os.path.join in the /downloads/ endpoint. Any organization running vulnerable GateOne instances is at risk of sensitive file disclosure.
💻 Affected Systems
- GateOne
📦 What is this software?
Gateone by Liftoffsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through disclosure of sensitive configuration files, SSH keys, passwords, or other credentials leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive server files including configuration files, logs, and potentially user data stored on the server.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation is trivial using simple HTTP requests with directory traversal sequences. Public proof-of-concept code and writeups are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GateOne 1.2 or later
Vendor Advisory: https://github.com/liftoff/GateOne/issues/747
Restart Required: Yes
Instructions:
1. Upgrade GateOne to version 1.2 or later. 2. Stop the GateOne service. 3. Install the updated version. 4. Restart the GateOne service. 5. Verify the fix by testing the /downloads/ endpoint.
🔧 Temporary Workarounds
Web Server URL Rewrite
linuxConfigure web server (Apache/Nginx) to block directory traversal attempts in the /downloads/ path
For Nginx: location ~ ^/downloads/.*\.\. { deny all; }
For Apache: RewriteRule ^downloads/.*\.\. - [F]
Access Control Restriction
linuxRestrict access to GateOne web interface using firewall rules or authentication
iptables -A INPUT -p tcp --dport [GateOne_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [GateOne_port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit GateOne access to trusted IP addresses only
- Deploy a web application firewall (WAF) with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Test by attempting to access /downloads/../../../etc/passwd on the GateOne web interface. If the file downloads, the system is vulnerable.Check Version:
Check GateOne version in web interface or run: python -c "import gateone; print(gateone.__version__)"Verify Fix Applied:
After patching, attempt the same directory traversal test. The request should be blocked or return an error.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '/downloads/' with '..' sequences
- Unusual file access patterns from GateOne process
Network Indicators:
- HTTP GET requests to /downloads/ with directory traversal patterns
- Multiple sequential file download attempts
SIEM Query:
source="gateone.log" AND (uri_path="/downloads/*" AND uri_path="*..*")