HGiga MailSherlock - Arbitrary File Download

Vulnerability

HGiga MailSherlock contains an arbitrary file download vulnerability in the view_source function. The application fails to validate or sanitize user-supplied path characters, allowing an attacker to traverse directories. Affected versions are not explicitly enumerated in the advisory, but the flaw is confirmed by TWNCERT [1].

Exploitation

A remote attacker can send a crafted HTTP request to the vulnerable endpoint, supplying path traversal sequences such as ../ in the file parameter. No authentication is required. The attacker simply needs network access to the MailSherlock server [1].

Impact

Successful exploitation enables the attacker to read any file on the system that the web server process can access. This may include configuration files, private keys, or sensitive data, leading to information disclosure [1].

Mitigation

HGiga has released a security update; users should upgrade to the latest version as indicated on the vendor's advisory page. If patching is not immediately possible, restrict network access to the MailSherlock web interface to trusted hosts [1].