TMAN Designer Unauth File-Content API: Unauth Arbitrary File Read/Write to RCE

Vulnerability Summary: TMAN Designer File Content API Unauthenticated Arbitrary File Read/Write (Can Lead to RCE) Overview Vulnerability Type: Unauthenticated arbitrary file read and write (scalable to Remote Code Execution, RCE) Affected Component: The file content API within the backend (HTTP service) of TMAN Designer Root Cause: The server utilizes the file path provided by the caller without enforcing path restrictions or authentication. The default configuration allows any origin for CORS, enabling unauthenticated external web pages to invoke the API cross-origin to read and write arbitrary files. Severity: Critical (CVSS 3.1: 9.8 Critical) CWE: CWE-306 (Missing Authentication) / CWE-22 (Path Traversal) Scope of Impact Affected Versions: (under default configuration) Affected Endpoints: - (Write) - (Read) By default, the service binds to with CORS, allowing access without credentials. Capable of writing to files such as or , thereby enabling code execution. POC / Exploitation Code Verification Results: Writing to returned Reading returned No credentials were used, confirming the API is unauthenticated. Remediation 1. Path Restrictions: Restrict to within the project directory; reject absolute paths and path traversal sequences such as . 2. Add Authentication: Enable identity authentication (e.g., Token / Session) on the Designer API. 3. Tighten CORS: Change the default from any origin to same-origin or specified origins to prevent cross-origin calls from arbitrary sources. 4. Restrict Write Scope: By default, only allow writes within the project workspace; prohibit writing to critical system files (e.g., , , etc.). 5. Version Upgrade: Upgrade to a patched version (if an official patch has been released).

Goal Reached Thanks to every supporter — we hit 100%!

TMAN Designer Unauth File-Content API: Unauth Arbitrary File Read/Write to RCE

More from this source