Security researcher Derek Abdine has published an advisory about vulnerabilities that exist in the MIT-licensed muhttpd web server. This web server is present in Arris firmware which can be found in several router models.
A path traversal attack aims to access files and directories stored outside the web root folder. These attacks are sometimes referred to as dot-dot-slash attacks since they manipulate variables that reference files with “dot-dot-slash (../)” sequences and variations of them to access arbitrary files and directories.
Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). Derek Abdine found several vulnerabilities, one of which is:
CVE-2022-31793: Path traversal from the filesystem root. Simply prepending a single character that is not a dot (“.”), forward slash (“/”) or question mark (“?”) before the requested path is sufficient to obtain any regular file on the device.
