Path Traversal Vulnerability in Risesoft Digital-Infrastructure

Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 contain a path traversal vulnerability in the Y9FileController.retrieveFileStream handler within the fileManager component. This vulnerability stems from improper validation of user-supplied input in the fullPath and fileName parameters, allowing unauthenticated attackers to escape the intended directory scope. By sending crafted HTTP GET requests to the /rest/retrieveFileStream endpoint, an attacker can access arbitrary files on the underlying filesystem. This flaw poses a significant risk, as it enables the retrieval of sensitive configuration files such as application.yml. Successful exploitation results in the exposure of database, Redis, and Nacos credentials, which could lead to further unauthorized access, data exfiltration, or complete compromise of the backend infrastructure.

Impact

Successful exploitation allows unauthenticated attackers to read any file on the server accessible to the application process. In enterprise environments, this typically leads to the theft of environment configuration files containing clear-text credentials for database, Redis, and Nacos instances. This exposure can facilitate lateral movement within the network and potential compromise of the entire application deployment.

Recommendation

• Patch Risesoft Digital-Infrastructure to the latest version available after 9.6.11 immediately.
• Monitor web server logs for requests to the /rest/retrieveFileStream endpoint containing path traversal sequences (e.g., ../ or ..).
• Enforce strict input validation on all application parameters that influence file path construction.
• Review logs for unauthorized access patterns specifically targeting configuration files like application.yml.