WF Steuerungstechnik GmbH airleader MASTER Path Traversal Vulnerability

A path traversal vulnerability has been identified in WF Steuerungstechnik GmbH's airleader MASTER version 3.0046. This vulnerability allows an unauthenticated attacker to read arbitrary files from the server, outside the web server's document directory, potentially leading to the exposure of sensitive information that could be used in further attacks.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive files on the server, including potentially critical system or application data.

Reproduction

The vulnerability can be reproduced by sending a GET request that includes a crafted URL designed to traverse directories. This request can be used to access files such as '/etc/passwd' on the server, indicating the ability to read arbitrary files through the path traversal flaw.

Remediation

Users can upgrade to airleader MASTER version 3.0057, which addresses the path traversal vulnerability.