Risesoft-Y9 Digital-Infrastructure Path Traversal Vulnerability in File Deletion Function

A critical path traversal vulnerability has been identified in Risesoft-Y9 Digital-Infrastructure versions through 9.6.7. The issue arises in the Y9FileController.java file, specifically within the deleteFile function. The vulnerability allows for the manipulation of the fullPath argument, enabling remote attackers to traverse directories and potentially delete arbitrary files on the server. This exploitation could lead to unauthorized file deletion, impacting the integrity and availability of the application.

Impact

Exploitation of this vulnerability allows for path traversal, enabling attackers to access directories and files outside of the intended scope. In this case, it could be used to delete arbitrary files on the server, disrupting the application's functionality and potentially causing data loss.

Reproduction

To reproduce this vulnerability, send a request to the /fileManager/rest/deleteFile endpoint with a crafted fullPath parameter that exploits the lack of proper path validation. This can be done by including directory traversal sequences in the parameter to navigate outside of the restricted directory and target sensitive files for deletion.