Attack Chain

1. Attacker obtains valid credentials for the Torrent Suite Software application.
2. Attacker interacts with the web interface to identify input parameters that handle file paths.
3. Attacker crafts a malicious HTTP request containing path traversal sequences (e.g., ../../).
4. Attacker sends the crafted request to the vulnerable web endpoint.
5. The application fails to sanitize the path, resolving the directory traversal.
6. The web service retrieves the contents of the targeted file.
7. The application returns the contents of the unauthorized file in the HTTP response.
8. Attacker gains access to sensitive system or application files for further reconnaissance or exfiltration.

Impact

Successful exploitation could result in the disclosure of sensitive files residing on the Torrent Server. This vulnerability affects Torrent Suite Software versions 5.18 and earlier globally. Impacted organizations in the healthcare sector could face exposure of clinical data, configuration files, or credentials stored on the server, potentially leading to a broader compromise of laboratory workflows or network environments.

Recommendation

• Upgrade Thermo Fisher Torrent Suite Software to version 5.22 or later immediately as recommended by the vendor.
• Restrict network access to the Torrent Suite Software web interface, ensuring it is not reachable from the public internet.
• Implement firewall rules to isolate control system networks from general business networks.
• Audit web server logs for anomalous requests containing path traversal patterns (e.g., encoded or repeated '../' sequences) directed at application endpoints.
• Enforce strong authentication controls to prevent unauthorized access, as the vulnerability requires an authenticated session.