Description

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T09:16:47.740Z",
  "pubdate": "2026-08-20T09:16:47.740Z",
  "executiveSummary": "An unauthenticated remote file disclosure vulnerability has been identified within the FDS Web server. This security flaw allows unauthenticated remote attackers to directly retrieve sensitive system files over HTTP without requiring a valid user session or authentication credentials. The affected components include critical backup archives and downloadable resources, specifically exposing paths such as /FdsBackup.zip and files located under /downloads/*.\nThe impact of this vulnerability is severe, as the retrieved files disclose highly confidential operational data, specifically detailing railway signaling and track layout information. The exposure of this proprietary and safety-critical infrastructure data poses significant operational risks and compromises the physical and logical security posture of the railway systems managed by the software.\nExploitation of this vulnerability requires network connectivity to the vulnerable FDS Web server and knowledge of, or ability to probe for, predictable static file paths. No specialized privileges, user interaction, or valid authentication tokens are required by the attacker to successfully execute the retrieval of sensitive artifacts. Remediation necessitates enforcing strict authentication and authorization controls across all sensitive endpoints and restricting public or unauthenticated access to backup archives and download directories.",
  "technicalDetails": "The vulnerability resides in the access control implementation of the FDS Web server component, which fails to properly validate user sessions and authorization states before serving sensitive content over the HTTP protocol. Specifically, the web application exposes static resource handlers and file retrieval mechanisms that permit direct, unauthenticated access to restricted filesystem locations.\nThe vulnerable component handles HTTP GET requests destined for specific administrative and resource-oriented URIs without enforcing security checks. Attackers can leverage standard web browsing tools or automated scripting to directly request sensitive paths, such as /FdsBackup.zip and arbitrary files residing within the /downloads/* directory structure.\nThe root cause of the flaw is the absence of session validation and role-based access control (RBAC) checks on sensitive endpoints. The web server implicitly trusts incoming HTTP requests for these resources, assuming they are protected by network-level segmentation or obscurity rather than proper application-layer access controls.\nThe attack flow proceeds as follows: 1) The unauthenticated attacker identifies the exposure of the FDS Web server over the network. 2) The attacker crafts an HTTP GET request targeting known or guessed sensitive file paths, such as requesting the backup archive directly via http://<target-ip>/FdsBackup.zip or iterating through files under http://<target-ip>/downloads/. 3) The FDS Web server processes the request without validating session tokens or authentication headers. 4) The server directly reads the requested files from the underlying filesystem and streams them back in the HTTP response body. 5) The attacker receives the sensitive files, successfully bypassing all authentication and authorization boundaries.\nThe post-exploitation impact includes the total compromise of confidentiality regarding critical infrastructure configurations. The exposed backup archive (/FdsBackup.zip) and files under /downloads/* contain detailed railway signaling logic, track layout schematics, and potentially system configuration data. This information can be analyzed offline by malicious actors to identify system vulnerabilities, understand physical railway topologies, or plan subsequent targeted attacks against physical or cyber-physical railway assets. The vulnerability is entirely network-exploitable, requiring zero privileges and no user interaction."
}