JVN#12884935
FileZen vulnerable to directory traversal
Overview
FileZen provided by Soliton Systems K.K. contains a directory traversal vulnerability.
Products Affected
- FileZen versions from V3.0.0 to V4.2.2
Description
FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface.
FileZen contains a directory traversal vulnerability (CWE-22).
Impact
A remote attacker may upload an arbitrary file in the specific directory in the product.
If a specialy crafted file is uploaded by an attacker, it may lead to an arbitrary OS command execution.
Solution
Update the software
Update the software to the latest version according to the information provided by the developer.
According to the developer, this vulnerability has been already addressed in V4.2.3 released on January 30, 2019.
In addition, the possible arbitrary OS command execution issue has been addressed in the following versions.
- V4.2.6 (Released on December 7, 2020)
- V5.0.1 (Released on December 9, 2020)
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| Soliton Systems K.K. | Vulnerable | 2020/12/10 | Soliton Systems K.K. website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Soliton Systems K.K. coordinated under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
JPCERT-AT-2020-0044 Alert Regarding File Data Transfer Appliance FileZen |
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2020-5639 |
| JVN iPedia |
JVNDB-2020-000082 |