Foreced Browsing vulnerability in products of MB connect line and Helmholz

Vulnerability

In mymbCONNECT24, mbCONNECT24, myREX24, and myREX24.virtual through version 2.11.2, an unauthenticated attacker can access files that should have been restricted via forceful browsing (direct URL traversal). The issue exists because access controls are not properly enforced for certain file resources.

Exploitation

An unauthenticated attacker can simply send crafted HTTP requests to access files that should not be publicly accessible. No authentication or special privileges are required. The attacker may enumerate file paths or use common directory traversal patterns to retrieve sensitive data.

Impact

Successful exploitation allows an unauthenticated attacker to read restricted files, potentially exposing sensitive configuration data, credentials, or other internal information. This leads to information disclosure.

Mitigation

Update to version 2.12.1 or later, as recommended in the VDE advisory [2][3]. Affected product lines include mymbCONNECT24 and mbCONNECT24 (VDE-2021-003) as well as Helmholz myREX24 and myREX24.virtual (VDE-2022-039). The fix was released for version 2.12.1.