Four-Faith Water Conservancy Informatization Platform Path Traversal Vulnerability Allowing Arbitrary File Read

A critical path traversal vulnerability has been identified in the Four-Faith Water Conservancy Informatization Platform, affecting versions through 2.2. The vulnerability resides in the download.do endpoint, where the fileName parameter is not properly validated, allowing remote attackers to read arbitrary files from the server, including sensitive configuration data. This issue has been publicly disclosed, and the vendor has not responded to initial reports.

Impact

Exploitation of this vulnerability allows unauthorized users to read any file on the server, potentially including sensitive information such as configuration files and other critical data.

Reproduction

To reproduce this vulnerability, send a GET request to the download.do endpoint with a crafted fileName parameter that includes directory traversal sequences. This request can be made using a web browser or a tool like curl. The target server must be running a vulnerable version of the Four-Faith Water Conservancy Informatization Platform.