Attack Chain

1. Attacker identifies a public-facing instance of the YouTransfer application.
2. Attacker crafts a malicious HTTP request targeting the /settings/template endpoint.
3. The request includes directory traversal sequences (such as ../) within a parameter expected by the template rendering function.
4. The application fails to properly sanitize the input before passing it to the file system handler.
5. The file system handler resolves the traversed path to an unintended location on the host server.
6. The application retrieves the content of the target file based on the manipulated path.
7. The application returns the contents of the unauthorized file in the HTTP response body to the attacker.

Impact

Successful exploitation of this path traversal vulnerability allows an unauthenticated remote attacker to read arbitrary files from the underlying server's file system. This can lead to the exposure of sensitive configuration files, source code, credentials, or system information, potentially facilitating further compromise of the environment.

Recommendation

Prioritize the identification of all internet-facing instances of YouTransfer within your network environment. Given the lack of a vendor-provided patch, implement the following actions:

• Configure web application firewalls (WAF) or ingress filtering to block requests containing directory traversal sequences (e.g., "..", "%2e%2e/") targeting the /settings/template path.
• Audit web server access logs for anomalous GET or POST requests directed at /settings/template that utilize directory traversal patterns.
• Restrict network access to the YouTransfer administrative or settings interface to authorized internal IP ranges only.