ZenTao Easy soft ALM v16.5 Directory Traversal Vulnerability (CVE-2022-37700) Advisory

Vulnerability Overview Vulnerability Name: CVE-2022-37700 Vulnerability Type: Directory Traversal Affected Software: ZenTao Easy soft ALM v16.5 Vulnerability Description: This vulnerability allows attackers to read arbitrary files on the server, including application assets, backend system credentials, and sensitive operating system files. In some cases, attackers can tamper with arbitrary files on the server, thereby gaining full control over the server running the application. Scope of Impact Affected Versions: ZenTao Easy soft ALM v16.5 Exploitation: Through the directory traversal vulnerability, attackers can read sensitive configuration files, such as . Remediation 1. Strictly validate user input: Before passing user-provided dynamic input to any file system operation, it should be strictly validated. After validation, the application can use appropriate file system APIs to verify that the file is located within the base directory used by the application. 2. Block input containing dot-dot-slash sequences: Block input containing the sequence. 3. Store files on a separate logical volume: Files accessed using user-provided dynamic input should be stored on a separate logical volume distinct from other sensitive application and operating system files to prevent access via path traversal attacks. 4. Use multiple layers of defense: If it is unavoidable to pass user-provided data to input file system APIs, a two-layer defense strategy should be employed: - Step 1: The application should validate user input before processing by comparing it against allowed whitelist values. If this is not possible, validation should be based on "alphanumeric characters." - Step 2: After validation, the application should append the input to the base directory and normalize the path using platform file system APIs. 5. Avoid storing sensitive data in the web root directory: Developers should avoid storing sensitive data within the web root directory of the application. 6. Run the latest version of the web server: It is recommended to run the latest version of the web server, as they typically have robust directory security. If possible, ensure that the latest version (synchronized with current patches) is being run. POC Code References PortSwigger - Web Security: File Path Traversal Acunetix - Directory Traversal PortSwigger - Patched WordPress Plugin Still Susceptible to Attacks PortSwigger - Vulnerability Found in Oracle Terminals OWASP - Directory Traversal File Include Summary This vulnerability allows attackers to read arbitrary files on the server via directory traversal, affecting the ZenTao Easy soft ALM v16.5 version. Remediation measures include strictly validating user input, blocking specific sequences, storing files on separate logical volumes, employing multiple layers of defense, avoiding storing sensitive data in the web root directory, and running the latest version of the web server.

Goal Reached Thanks to every supporter — we hit 100%!

ZenTao Easy soft ALM v16.5 Directory Traversal Vulnerability (CVE-2022-37700) Advisory