Multiple vulnerabilities in TecRail Responsive FileManager

Published: 2018-08-24 | Updated: 2020-07-17

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-15535 CVE-2018-15536
CWE-ID	CWE-22
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Responsive FileManager Client/Desktop applications / File managers, FTP clients
Vendor	TecRail

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU31225

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2018-15535

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Responsive FileManager: 9.13.0 - 9.13.3

Fixed software versions

CPE2.3

cpe:2.3:a:tecrail:responsive_filemanager:9.13.0:*:*:*:*:*:*:*

External links

http://seclists.org/fulldisclosure/2018/Aug/34
http://www.exploit-db.com/exploits/45271/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Path traversal

EUVDB-ID: #VU31226

Risk: Low