StarNet FastX Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in StarNet FastX versions 4.0.0 through 4.1.51. This vulnerability allows unauthenticated attackers to read arbitrary files on the server. Exploiting this issue could lead to access to the application's configuration file, which contains the secret key for signing JSON Web Tokens (JWTs). With this key, an attacker could forge valid JWTs, impersonate any user, and execute remote code via authenticated endpoints.

Impact

Successful exploitation allows for arbitrary file reading, with potential access to sensitive information such as the application's JWT signing key, leading to forged JWTs and remote code execution via authenticated endpoints.