CVE-2016-1610

published 2016-08-01

CVE-2016-1610: Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote…

Priority P2 61 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I H A N

EXPLOIT

Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
novell	filr	<= 1.2	—
novell	filr	<= 2.0	—

Detection & IOCs extracted from sources · hover to see the quote

path ../../../../etc/profile.d/vainit.sh↗

path /tmp/profiledtest↗

url ssf/gwt/gwtTeaming.rpc↗

command id > /tmp/profiledtest↗

• → Monitor for creation or modification of files under /etc/profile.d/ by the Filr/Jetty process (vabase-jetty), which would indicate successful exploitation of the directory traversal write primitive. ↗
• → Alert on POST requests to /ssf/gwt/gwtTeaming.rpc from unauthenticated sessions (no valid session cookie) containing blob name parameters with '../' sequences. ↗
• → Detect session cookies lacking the httpOnly flag on Filr appliances, which facilitates session hijacking as a precursor to exploitation. ↗
• → Monitor for unexpected files or script execution originating from /tmp/profiledtest or similar /tmp paths, indicating post-exploitation command execution via the written profile.d script. ↗

• · The GWT RPC policy name (338D4038939D10E7FC021BD64B318D99) used in the PoC exploit is hardcoded and may differ across Filr versions or deployments; detections relying on this value should be validated against the target environment. ↗
• · The Filr Jetty service runs as 'vabase-jetty' but delegates privileged actions to a root-running service; the traversal write impact is therefore elevated to root-level file writes despite the service account. ↗
• · The httpOnly cookie flag issue will not be addressed in the Security Update 2/3 patches and remains unmitigated in patched versions; session theft via XSS remains possible. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22