Chunghwa Telecom TenderDocTransfer Arbitrary File Deletion Vulnerability

An arbitrary file deletion vulnerability has been identified in TenderDocTransfer, a file transfer application developed by Chunghwa Telecom, prior to version 0.41.159. The vulnerability arises from the application's local web server, which exposes APIs for communication with target websites. These APIs lack Cross-Site Request Forgery (CSRF) protection, allowing unauthenticated remote attackers to exploit them, potentially through phishing. One of the APIs is vulnerable to absolute path traversal, enabling attackers to delete arbitrary files from the user's system.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of files on the user's system.

Remediation

Users are advised to update TenderDocTransfer to version 0.41.159 or later.