Description

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T15:17:38.607Z",
  "pubdate": "2026-09-03T15:17:38.607Z",
  "executiveSummary": "DbGate suffers from a critical path traversal and arbitrary file access vulnerability located within the jsldata controller.\nThe vulnerability originates from improper input validation of jslid parameters, which fails to restrict file path resolution.\nThis flaw enables authenticated attackers to leverage the file:// scheme to bypass directory containment mechanisms.\nSuccessful exploitation allows for arbitrary reading and writing of files on the host filesystem, posing a severe risk to confidentiality and integrity.\nNotably, attackers can access sensitive configuration files containing encrypted database credentials stored in the application's connection settings.\nThe vulnerability is accessible to authenticated users and does not require elevated system privileges, though it necessitates a successful session within the application.\nThe primary risk implication is full system compromise or persistence via unauthorized configuration modification and sensitive data exfiltration.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of the jsldata controller, specifically within the getJslFileName() function, which is responsible for resolving file paths requested via the jslid parameter.\nThe application fails to sanitize or validate the user-supplied input provided to the jslid parameter, allowing for the inclusion of directory traversal sequences and protocol identifiers.\nBy manipulating the jslid parameter, an attacker can invoke the file:// URI scheme, effectively forcing the application's file system abstraction layer to process arbitrary paths outside of the intended directory context.\nThe attack flow begins with an authenticated user crafting a malicious request to the jsldata endpoint. By providing a crafted jslid value (e.g., using traversal sequences like ../ or absolute paths combined with the file:// protocol), the attacker bypasses the directory containment logic enforced by the application.\nBecause the getJslFileName() function does not perform adequate canonicalization or path verification before passing the input to underlying file system APIs, the system resolves the path provided by the attacker.\nThis functionality allows the attacker to read sensitive files, such as application configurations, environment variables, or encrypted credentials stored in the connections configuration files. Furthermore, if the controller implementation includes write operations, an attacker can modify arbitrary files, potentially leading to remote code execution (RCE) by overwriting application source files or configuration binaries.\nExploitation is facilitated by the application's trust in the input provided to the jslid parameter, assuming it adheres to expected naming conventions rather than enforcing strict allow-listing or chroot-like restrictions.\nThe impact is significant: the ability to read arbitrary files permits the extraction of sensitive secrets, potentially allowing the attacker to decrypt stored database credentials or hijack administrative sessions. The ability to write arbitrary files provides a direct path to total system compromise, where an attacker could inject malicious scripts or alter system files to establish persistent backdoor access.\nThis vulnerability is classified as a lack of input validation leading to file system access, emphasizing the necessity for robust path canonicalization and restricted file system access policies within the controller layer."
}