CVE-2021-33807

published 2021-07-12

CVE-2021-33807: Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.

Priority P2 62 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
gespage	gespage	<= 8.2.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /gespage/doDownloadData?file_name=../../../../../Windows/debug/NetSetup.log↗

path /gespage/doDownloadData↗

path /gespage/webapp/doDownloadData↗

• → HTTP GET request to the vulnerable endpoint with directory traversal sequences in the 'file_name' parameter targeting Windows system files (e.g., NetSetup.log) indicates active exploitation.
• → Response body containing 'NetpDoDomainJoin:' confirms successful directory traversal and file read from the Windows host.
• → Response Content-Type header of 'application/octet-stream' on the doDownloadData endpoint is a secondary indicator of successful file exfiltration via traversal.
• → Monitor for HTTP 200 responses to requests on /gespage/doDownloadData or /gespage/webapp/doDownloadData containing traversal sequences (e.g., '../') in the file_name query parameter.

• · The traversal payload shown targets Windows hosts specifically (Windows/debug/NetSetup.log); detection rules should also account for Linux/Unix path traversal variants (e.g., /etc/passwd) against the same endpoints.

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22