CVE-2023-39026
📋 TL;DR
This CVE describes a directory traversal vulnerability in FileMage Gateway Windows deployments that allows remote attackers to read sensitive files on the server. Attackers can exploit this by sending crafted requests to the /mgmt/ component. Organizations running FileMage Gateway v1.10.8 or earlier on Windows are affected.
💻 Affected Systems
- FileMage Gateway
📦 What is this software?
Filemage by Filemage
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading configuration files, credentials, or other sensitive data, potentially leading to lateral movement or data exfiltration.
Likely Case
Unauthorized access to sensitive files including configuration files, logs, and potentially credentials stored on the server.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to the vulnerable component.
🎯 Exploit Status
Public exploit details available via Packet Storm and other sources. Simple directory traversal techniques can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.10.9
Vendor Advisory: https://www.filemage.io/docs/updates.html#change-log
Restart Required: Yes
Instructions:
1. Download FileMage Gateway v1.10.9 or later from the official website. 2. Stop the FileMage Gateway service. 3. Install the updated version. 4. Restart the service.
🔧 Temporary Workarounds
Network Access Restriction
windowsBlock external access to the /mgmt/ endpoint using firewall rules or network segmentation.
Windows Firewall: New-NetFirewallRule -DisplayName "Block FileMage MGMT" -Direction Inbound -Protocol TCP -LocalPort <mgmt_port> -Action Block
Application Layer Filtering
allImplement WAF rules to block directory traversal patterns in requests to /mgmt/
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FileMage Gateway from untrusted networks
- Deploy a web application firewall (WAF) with rules to detect and block directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check if FileMage Gateway version is 1.10.8 or earlier and if Windows deployment has /mgmt/ endpoint accessible.Check Version:
Check FileMage Gateway web interface or configuration files for version informationVerify Fix Applied:
Verify installation of v1.10.9 or later and test that directory traversal attempts to /mgmt/ are properly blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing directory traversal sequences (../, ..\) to /mgmt/ endpoint
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests with ../ patterns in URL parameters or paths targeting /mgmt/
SIEM Query:
source="filemage" AND (url="*/mgmt/*" AND (url="*../*" OR url="*..\*"))🔗 References
- http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html
- https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
- https://www.filemage.io/docs/updates.html#change-log
- http://packetstormsecurity.com/files/174491/FileMage-Gateway-1.10.9-Local-File-Inclusion.html
- https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
- https://www.filemage.io/docs/updates.html#change-log
