Cybozu Dezie up to 8.1.2 HTTP Requests path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Cybozu Dezie up to 8.1.2. This issue affects some unknown processing. Executing a manipulation as part of HTTP Requests can lead to path traversal. This vulnerability is handled as CVE-2018-0705. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Cybozu Dezie up to 8.1.2. This vulnerability affects an unknown functionality. The manipulation as part of a HTTP Requests leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.

The bug was discovered 11/14/2018. The weakness was released 01/09/2019 with Oracle (Website). The advisory is shared for download at jvn.jp. This vulnerability was named CVE-2018-0705 since 11/27/2017. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability was handled as a non-public zero-day exploit for at least 56 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371180 (IBM Java SDK Multiple Vulnerabilities (Oracle July 17 2018 CPU (1.6.0_201, 1.7.0_191, 1.8.0_181))).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 104768†). Entries connected to this vulnerability are available at VDB-81142, VDB-82682, VDB-83122 and VDB-93149. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cybozu

Name

• Dezie

Version

• 8.1.0
• 8.1.1
• 8.1.2

License

• commercial

Website

• Vendor: https://cybozu-global.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion