CVE-2022-23347
📋 TL;DR
CVE-2022-23347 is a directory traversal vulnerability in BigAnt Server that allows attackers to access files outside the intended directory. This affects organizations using BigAnt Server v5.6.06 for collaboration and messaging. Attackers can potentially read sensitive system files through improper path validation.
💻 Affected Systems
- BigAnt Server
📦 What is this software?
Bigant Server by Bigantsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, credentials, or executing arbitrary code via file inclusion.
Likely Case
Unauthorized access to sensitive files containing configuration data, user information, or system details.
If Mitigated
Limited impact with proper network segmentation, file system permissions, and input validation in place.
🎯 Exploit Status
Public proof-of-concept code is available on GitHub. The exploit requires minimal technical skill as directory traversal attacks are well-documented and easy to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.6.07 or later
Vendor Advisory: https://www.bigantsoft.com/
Restart Required: Yes
Instructions:
1. Download the latest version from BigAnt Software website. 2. Backup current configuration and data. 3. Stop the BigAnt Server service. 4. Install the updated version. 5. Restore configuration if needed. 6. Start the service and verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall rules or input validation to block directory traversal sequences like '../' and absolute paths.
# Example WAF rule to block directory traversal
SecRule ARGS "\.\./" "id:1001,phase:2,deny,status:403,msg:'Directory Traversal Attempt'
File System Permissions
linuxRestrict BigAnt Server process permissions to only necessary directories using least privilege principles.
# Linux example: chown and chmod restrictions
chown -R bigant:bigant /opt/bigant/data
chmod 750 /opt/bigant
🧯 If You Can't Patch
- Implement network segmentation to isolate BigAnt Server from sensitive systems and limit access to trusted IPs only.
- Deploy a web application firewall with rules specifically blocking directory traversal patterns and monitor for attack attempts.
🔍 How to Verify
Check if Vulnerable:
Test by attempting to access files outside web root using '../' sequences in URL parameters. Monitor server response for file contents.Check Version:
Check BigAnt Server administration panel or run: bigant-server --version (Linux) or check installed programs in Windows Control Panel.Verify Fix Applied:
After patching, repeat the directory traversal tests. The server should return 403 Forbidden or error messages instead of file contents.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences
- Access to unusual file paths in web logs
- 403 Forbidden errors followed by successful file access
Network Indicators:
- Unusual file requests to BigAnt Server
- Patterns of directory traversal attempts in HTTP traffic
SIEM Query:
source="bigant_logs" AND (url="*../*" OR url="*..\\*" OR status=200 AND file_extension IN ('.conf', '.ini', '.txt', '.xml'))