MasterSAM Star Gate 11 Directory Traversal Vulnerability in Download Service

A directory traversal vulnerability has been identified in MasterSAM Star Gate 11, specifically within the downloadService endpoint. This issue allows attackers to manipulate the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information. The vulnerability arises because the application fails to validate file paths properly, and it can be exploited without authentication.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files on the server.

Reproduction

To reproduce this vulnerability, send a GET request to the /adama/adama/downloadService endpoint. Include a crafted file parameter that traverses directories to access restricted files. This can be done without authentication.