Path Traversal via an unauthenticated export/download action using client-controlled directory and filename parameters
An unauthenticated arbitrary file read vulnerability was identified in a public legacy web portal. A download/export action accepted client-controlled parameters for both the target directory and file name, allowing the backend to return local server files without proper validation, allowlisting, or path canonicalization.
Description
The public-facing distributor/partner portal, a legacy Java web application exposed behind an enterprise load balancer, exposes a download/export action without authentication, without a valid session, and without cookies.
The vulnerable action receives two client-controlled values:
- a directory path, and
- a filename inside that directory.
The backend then returns the requested file content directly to the client, without applying a whitelist, without canonicalizing the final path, and without restricting the read operation to a safe export directory.
