Path Traversal Vulnerability in YouTransfer Template Rendering

YouTransfer versions up to 0.0.7, 1.0.6, and 1.1.0 are vulnerable to a path traversal flaw located within the Template Rendering component, specifically involving the /settings/template file. This vulnerability is remotely exploitable without authentication, enabling an adversary to manipulate file paths and potentially access sensitive files on the host system. The vulnerability is publicly disclosed, and as the vendor has remained unresponsive to disclosure attempts, no official patches are currently available. Organizations utilizing YouTransfer should restrict access to the application interface or implement compensating controls to mitigate potential unauthorized file system access.

Attack Chain

1. Attacker identifies a public-facing instance of the YouTransfer application.
2. Attacker crafts a malicious HTTP request targeting the /settings/template endpoint.
3. The request includes directory traversal sequences (such as ../) within a parameter expected by the template rendering function.
4. The application fails to properly sanitize the input before passing it to the file system handler.
5. The file system handler resolves the traversed path to an unintended location on the host server.
6. The application retrieves the content of the target file based on the manipulated path.
7. The application returns the contents of the unauthorized file in the HTTP response body to the attacker.

Impact

Successful exploitation of this path traversal vulnerability allows an unauthenticated remote attacker to read arbitrary files from the underlying server's file system. This can lead to the exposure of sensitive configuration files, source code, credentials, or system information, potentially facilitating further compromise of the environment.

Recommendation

Prioritize the identification of all internet-facing instances of YouTransfer within your network environment. Given the lack of a vendor-provided patch, implement the following actions:

• Configure web application firewalls (WAF) or ingress filtering to block requests containing directory traversal sequences (e.g., "..", "%2e%2e/") targeting the /settings/template path.
• Audit web server access logs for anomalous GET or POST requests directed at /settings/template that utilize directory traversal patterns.
• Restrict network access to the YouTransfer administrative or settings interface to authorized internal IP ranges only.