Elastic Path 4.1 - '/manager/getImportFileRedirect.jsp?file' Traversal Arbitrary File Access

                							

                source: http://www.securityfocus.com/bid/28352/info

Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.

These issues include:

- A local file-include vulnerability.
- An arbitrary file-upload vulnerability.
- A directory-traversal vulnerability.

Note that attackers must be logged into the application to exploit issues.

Exploiting these issues can allow attackers to access potentially sensitive information or to execute arbitrary script code in the context of the webserver process. Other attacks may also be possible.

Elastic Path 4.1 and 4.1.1 are vulnerable; other versions may also be affected. 

http://www.example.com/elasticpath_dir/manager/getImportFileRedirect.jsp?type=mapping&file=../../../../../boot.ini