我們使用 cookie 來幫助我們改善網頁體驗。請閱讀我們的 Cookie 政策 。

ASUSTOR 產品安全性諮詢

AS-2023-007: EZ Sync on ADM

2023-06-29

Severity

Important

Status

Resolved

Statement

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files.

  • The issue has been fixed on ADM 4.2.2.RI61 and ADM 4.0.6.RIS1.

Affected Products

Product Severity Fixed Release Availability
ADM 4.2 and 4.1 Important Upgrade to ADM 4.2.2.RI61 or above.
ADM 4.0 Important Upgrade to 4.0.6.RIS1 or above.

Detail

  • CVE-2023-2909
    • Severity: High
    • CVSS3 Base Score: 8.5
    • CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    • EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below.

Acknowledgement

JuYang.Gao (chumen77) from Dbappsecurity Co.,Ltd


Revision

Revision Date Description
1 2023-05-31 Initial public release.
2 2023-05-31 CVE ID (CVE-2023-2909) is assigned for the issue.
3 2023-06-06 Release ADM 4.2.2.RI61 to fix the issue.
4 2023-06-29 Release ADM 4.0.6.RIS1 to fix the issue.