CVE-2024-58406

Name of the Vulnerable Software and Affected Versions Huatian Dynamic OA8000 (affected versions not specified)

Description An unauthenticated path traversal issue exists in the '/OAapp/jsp/trace/ntkodownload.jsp' endpoint. The filename request parameter is used to locate files without restricting access to the intended directory or rejecting traversal sequences. This allows attackers to use ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at 'ROOT/WEB-INF/web.xml', potentially exposing sensitive configuration, source code, and credentials. Real-world exploitation was first observed by the Shadowserver Foundation on 2024-11-20.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the filename parameter in the '/OAapp/jsp/trace/ntkodownload.jsp' endpoint until the issue is resolved.