CVE-2022-51022

Summary

The YiShaAdmin application (versions 2.2–3.1) contains a path traversal vulnerability in its /admin/File/DownloadFile endpoint, allowing unauthenticated attackers to read and delete arbitrary files on the server by manipulating the filePath parameter with directory traversal sequences.

Exploitability

Exploitation is trivial for remote attackers as it requires no authentication, user interaction, or special conditions—only a network-accessible endpoint.

Blast radius

Successful exploitation could lead to full compromise of confidentiality (via reading sensitive files like /etc/passwd) and availability (via deleting critical system or application files), potentially enabling further attacks such as credential theft or service disruption.

Detection

Defenders should monitor web server access logs for requests to /admin/File/DownloadFile containing path traversal sequences (e.g., ../) in the filePath query parameter, especially when combined with a delete=true parameter; such requests are highly suspicious and likely indicate exploitation attempts.

Prioritized remediation

Upgrade to YiShaAdmin version 3.2 or later, which includes the fix from commit 025b062; if upgrading is not immediately possible, disable or restrict access to the /admin/File/DownloadFile endpoint and remove the delete parameter functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.