Security Advisory
VanDyke Software VShell HTTPS Directory Traversal
Risk assessment: Medium
Posted: October 28, 2020
Description
Given a maliciously crafted URL, VShell Enterprise Edition with HTTPS was vulnerable to a directory traversal attack using HTTP requests, allowing potentially unauthorized access to the file system.
The VShell HTTPS file transfer server installation includes a subdirectory containing files needed to display the VShell Web User Interface. Anonymous HTTP access to these files is allowed in order to display the interface. By using a URL constructed with UTF-8 representations of special elements such as ".." and "/", an attacker could access files outside of the restricted location.
Products Not Affected
- VShell Administrator, Workgroup, and Enterprise Editions:
- All versions for Windows, Linux, and Mac
- VShell Enterprise Edition with HTTPS:
- Versions 4.5.2 and newer for Windows, Linux, and Mac
Products Affected
- VShell Enterprise Edition with HTTPS:
- Versions 4.4.0 through 4.5.1 for Windows
- Versions 4.5.0 and 4.5.1 for Linux and Mac
Recommended Solution
Upgrade to VShell with HTTPS version 4.5.2 or newer.
Vulnerability Fix Downloads
Technical Support
If you have any questions concerning upgrade eligibility in response to this security advisory, please send an email with your registered serial number to VanDyke Software Technical Support at
.
Official Postings
N/A
Revision History
January 28, 2020 – Download links made available for VShell HTTPS 4.5.2
October 28, 2020 – Security Advisory Published
