CVE-2021-33807
📋 TL;DR
CVE-2021-33807 is a directory traversal vulnerability in Cartadis Gespage up to version 8.2.1, allowing attackers to access arbitrary files on the server via the gespage/doDownloadData and gespage/webapp/doDownloadData endpoints. This affects organizations using vulnerable Gespage software for print management, potentially exposing sensitive system files.
💻 Affected Systems
- Cartadis Gespage
📦 What is this software?
Gespage by Gespage
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, passwords, or system data, leading to full system compromise or data exfiltration.
Likely Case
Unauthorized access to internal files, potentially exposing credentials or sensitive information stored on the server.
If Mitigated
Limited impact if access controls restrict file permissions or the server is isolated, but still poses a data leakage risk.
🎯 Exploit Status
Exploitation involves simple HTTP requests to traverse directories; public proof-of-concept examples are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 8.2.1 (check vendor for specific fixed version)
Vendor Advisory: https://support.gespage.com/fr/support/solutions/articles/14000130201-security-advisory-gespage-directory-traversal
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download and apply the latest patch from the vendor. 3. Restart the Gespage service. 4. Verify the fix by testing the vulnerable endpoints.
🔧 Temporary Workarounds
Restrict Access to Vulnerable Endpoints
allUse web server rules (e.g., Apache .htaccess or Nginx config) to block or restrict access to /gespage/doDownloadData and /gespage/webapp/doDownloadData paths.
# Example for Apache: RewriteRule ^/gespage/(doDownloadData|webapp/doDownloadData) - [F]
# Example for Nginx: location ~ /gespage/(doDownloadData|webapp/doDownloadData) { deny all; }
🧯 If You Can't Patch
- Implement network segmentation to isolate the Gespage server from sensitive systems.
- Monitor and log access to the vulnerable endpoints for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Send an HTTP request to http://<server>/gespage/doDownloadData?file=../../etc/passwd (or similar) and check if it returns sensitive file content.Check Version:
Check the Gespage web interface or configuration files for version information; command varies by installation.Verify Fix Applied:
After patching, repeat the vulnerable request; it should return an error or no sensitive data.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /gespage/doDownloadData or /gespage/webapp/doDownloadData with directory traversal patterns (e.g., '..' or '../') in query parameters.
Network Indicators:
- Unusual outbound traffic from the Gespage server indicating data exfiltration.
SIEM Query:
Example: source="gespage_logs" AND url="*doDownloadData*" AND (query="*..*" OR query="*../*")🔗 References
- https://support.gespage.com/fr/support/solutions/articles/14000130201-security-advisory-gespage-directory-traversal
- https://www.cartadis.com/gespage-website/
- https://www.gespage.com
- https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_gespage_-_cve-2021-33807.pdf
- https://support.gespage.com/fr/support/solutions/articles/14000130201-security-advisory-gespage-directory-traversal
- https://www.cartadis.com/gespage-website/
- https://www.gespage.com
- https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_gespage_-_cve-2021-33807.pdf
