CVE-2022-24241
📋 TL;DR
ACEweb Online Portal 3.5.065 contains a path traversal vulnerability in the txtFilePath parameter of attachments.awp that allows attackers to read arbitrary files on the server. This affects all organizations using this specific version of ACEweb Online Portal. The vulnerability enables unauthorized access to sensitive system files.
💻 Affected Systems
- ACEweb Online Portal
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, credentials, or system files leading to further exploitation.
Likely Case
Unauthorized access to sensitive application data, configuration files, or user information stored on the server.
If Mitigated
Limited impact with proper file system permissions and input validation in place.
🎯 Exploit Status
The vulnerability appears to be straightforward to exploit via path traversal techniques in the txtFilePath parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.aceware.com/forum/viewtopic.php?f=7&t=481
Restart Required: No
Instructions:
1. Check vendor forum for updates
2. Upgrade to a patched version when available
3. Apply input validation to txtFilePath parameter
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict file paths to allowed directories only
Implement path validation in attachments.awp to prevent directory traversal
Web Application Firewall Rule
allBlock requests containing path traversal sequences in the txtFilePath parameter
WAF rule: Block requests with '..', '../', or absolute paths in txtFilePath parameter
🧯 If You Can't Patch
- Implement strict file system permissions to limit what files the web server can access
- Deploy a web application firewall with rules to detect and block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Test if the attachments.awp endpoint accepts path traversal sequences in the txtFilePath parameterCheck Version:
Check ACEweb Online Portal version in administration panel or configuration filesVerify Fix Applied:
Verify that path traversal attempts are rejected and only allowed file paths are processed📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Requests to attachments.awp with suspicious path parameters
Network Indicators:
- HTTP requests containing path traversal sequences (../, ..\) in parameters
SIEM Query:
web.url:*/attachments.awp* AND (web.param.txtFilePath:*..* OR web.param.txtFilePath:*../*)