CVE-2023-51948

Vulnerability

The actidata actiNAS SL 2U-8 RDX device running firmware version 3.2.03-SP1 exposes a site-wide directory listing vulnerability. By accessing the /fm endpoint, the web application returns a listing of all files and directories hosted by the server, revealing the full application structure. The vendor has marked this product as End of Life (EOL) [1][2].

Exploitation

An attacker with network access to the device can simply send an HTTP GET request to the /fm path. No authentication is required. The server responds with a browsable directory index, enumerating all files in the web root [2].

Impact

Successful exploitation allows an unauthenticated remote attacker to discover the entire file layout of the web application, including configuration files, scripts, and potentially sensitive data. This information disclosure can aid further attacks by revealing application logic and credentials [2].

Mitigation

No official patch is available, as the product is End of Life and no longer supported [1]. The only effective mitigation is to decommission or isolate the device from untrusted networks. A reverse proxy or web application firewall may be used to block access to /fm as a partial workaround, but this does not fix the underlying vulnerability.