Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225

Vulnerability

Enphase IQ Gateway (formerly Envoy) versions 4.x through 8.0 and prior to 8.2.4225 are vulnerable to a path traversal vulnerability through a URL parameter [1]. The endpoint requires authentication [1]. The vulnerability allows an attacker to manipulate files by traversing outside of the restricted directory [1].

Exploitation

An attacker must be authenticated and able to reach the gateway over the network. The attack vector is feasible if the IQ Gateway is modified to obtain a public IP address and connect to the public internet [1]. The attacker can exploit the path traversal via a crafted URL parameter [1].

Impact

Successful exploitation allows file manipulation, potentially leading to arbitrary file read/write or modification on the device [1]. The impact could compromise the integrity and confidentiality of the gateway's data.

Mitigation

Enphase has released software version 8.2.4225 to fix this vulnerability [1]. The advisory recommends upgrading to this version or later. As a workaround, ensure the IQ Gateway is not exposed to the public internet; it is not needed for typical functionality [1].