JeeWMS Path Traversal Flaw Allows Unauthenticated File Access
Remote attackers can read arbitrary server files via a path traversal bug in JeeWMS, bypassing authentication controls to access sensitive data.
Key points
- The vulnerability is tracked as CVE-2021-48015 and rated high severity with a CVSS score of 8.7.
- Attackers exploit the dbPath parameter to read files like win.ini without logging in.
- Shadowserver Foundation observed exploitation evidence on October 17, 2023.
Remote attackers can read arbitrary files on servers running vulnerable versions of JeeWMS warehouse management software. The flaw allows unauthorized access to sensitive system data by bypassing authentication mechanisms. Exploitation evidence was first observed by the Shadowserver Foundation, indicating that the vulnerability has been targeted.
The risk
The vulnerability is identified as CVE-2021-48015 and carries a CVSS score of 8.7, which classifies it as high severity. It stems from improper handling of the dbPath parameter in web requests. Attackers send GET requests to the /systemController/showOrDownByurl.do endpoint with directory traversal sequences. These sequences bypass the AuthInterceptor component entirely.
Who is exposed
The issue affects erzhongxmu JeeWMS versions prior to commit 0a610e8178a0a1197e9c6615b58faf67c406d2bc. Any installation running these older builds is potentially vulnerable to remote file reads. The Shadowserver Foundation first observed evidence of exploitation on October 17, 2023. This confirms that the specific weakness has been targeted by attackers.
Cost and compliance
The source material does not provide specific financial impact figures or regulatory compliance consequences for this incident. Organizations should assess their own exposure based on the sensitivity of files stored on affected servers. Unauthorized access to configuration or system files could lead to further compromise.
What to watch
Security teams should monitor for unusual HTTP GET requests targeting the showOrDownByurl.do endpoint. Look for requests containing directory traversal patterns in the dbPath parameter. Verify that your JeeWMS version is not listed among the affected builds. Ensure that external scanning tools can reach these endpoints.
Signals worth monitoring
Teams usually detect this activity by reviewing web server access logs for requests to the showOrDownByurl.do endpoint containing directory traversal sequences. Check whether the dbPath parameter includes multiple dot-slash patterns. Monitor for successful retrieval of system files like win.ini from unauthenticated sources. Alert on any GET requests that bypass standard authentication interceptors. Investigate connections from known scanning infrastructure. Review firewall logs for repeated attempts to access restricted paths. Verify that logging captures full URL parameters for forensic analysis.
What to do and how to stay safe: JeeWMS
- Identify all JeeWMS installations and verify their version against the affected commit hash.
- Restrict access to the systemController endpoint using network firewalls or web application firewalls.
- Monitor server logs for requests containing directory traversal sequences in the dbPath parameter.
- Apply the vendor update once the vendor provides an update to address CVE-2021-48015.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the JeeWMS path traversal vulnerability?
The vulnerability is tracked as CVE-2021-48015.
Which versions of JeeWMS are affected by this flaw?
Versions before commit 0a610e8178a0a1197e9c6615b58faf67c406d2bc are affected.
When was exploitation of this vulnerability first observed?
Exploitation evidence was first observed by the Shadowserver Foundation on October 17, 2023.
