Embedded Web Server (.NET) - Potential Medium Security Vulnerability

Summary

A potential medium security vulnerability has been identified that could force the application to serve files outside of the web server's "www" directory, potentially leading to requests being sent to a server of the attacker's choosing. A successful exploit of this vulnerability would require:

• An attacker already possessing valid credentials to log into the application.
• An attacker possessing knowledge of the file system or network infrastructure, in order to know how to properly form the request to target a file or network resource.
• The application being hosted in the .NET Embedded Web server.
• The application's process being run with an identity that would have access to the requested file.

Resolution

The CData Security Team has investigated this as a high-priority issue and has updated the Windows/.NET editions of all potentially affected products. The fix for this issue has been applied to the following builds:

• CData Arc (V22.0.8473)
• CData API Server (V22.0.8500)
• CData Sync (V22.0.8483)

If you are using a previous version of any of the listed applications, please upgrade to the latest release.