i-doit Pro: Path traversal vulnerability (CVE-2023-37739)

i-doit Pro versions 25 and below contain a path traversal vulnerability. An authenticated attacker, regardless of privilege level, can exploit this flaw by manipulating the 'file' parameter within the 'file_manager' component to access unauthorized files on the underlying filesystem.

Attack Chain

1. Attacker authenticates to the i-doit Pro application with valid, potentially low-privileged, credentials.
2. Attacker identifies a target file on the host system to retrieve.
3. Attacker crafts an HTTP GET request to the application, specifically targeting the /index.php or /?moduleID endpoints.
4. Attacker injects path traversal sequences (e.g., ../../../) into the 'file' parameter of the 'file_manager' component.
5. The application fails to sanitize the input, allowing the traversal to escape the intended directory.
6. The application returns the contents of the requested file in the HTTP response.

Impact

Successful exploitation allows authenticated attackers to read sensitive system files, potentially leading to information disclosure of configuration files, credentials, or internal application logic.

Recommendation

1. Inventory all instances of i-doit Pro to identify versions 25 or below.
2. Apply security updates provided by synetics GmbH to remediate CVE-2023-37739.
3. Until patched, restrict access to the i-doit Pro administrative interface to trusted networks only.
4. Monitor web access logs for requests containing suspicious path traversal sequences (e.g., '../') directed at the 'file_manager' parameter.