TL;DR

IceWarp collaboration server suffers from a directory traversal info leak, CVSS score of 7.5, no authentication needed for exploit.

What happened

['A directory traversal vulnerability exists in IceWarp allowing attackers to read arbitrary files without needing login credentials']

Why it matters for ops

['Exploitation can lead to unauthorized access and disclosure of sensitive data', 'Potentially exposing configuration details or private user information']

Mitigation

  • Apply the latest security updates provided by IceWarp immediately
  • Restrict access to sensitive directories and files via server configurations

Action items

  • Scan systems for this specific vulnerability using available tools
  • Update affected IceWarp installations with patches or hotfixes

Detection IOCs

  • Unusual file system traversal attempts from untrusted sources
  • Unexpected network traffic patterns targeting IceWarp ports

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-130/