A directory traversal vulnerability in Bullwark Momentum Series JAWS 1.0 allows unauthenticated remote attackers to read sensitive system files, posing a significant risk to server confidentiality.

This is a directory traversal vulnerability (CWE-22) residing in the web server component. Unauthenticated attackers can exploit this by sending specially crafted GET requests containing multiple directory traversal sequences to access files outside the intended web root directory.

Successful exploitation of this vulnerability allows unauthorized access to sensitive system files, such as /etc/passwd, which can lead to the exposure of credentials or system configuration data. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the affected server environment, potentially providing an attacker with the necessary information to escalate privileges or perform further attacks.

Immediate Action: As no official vendor patch is available, administrators should restrict network access to the affected web server and implement strict input validation rules to block requests containing directory traversal patterns (e.g., ../).

Proactive Monitoring: Review web server access logs for anomalous GET requests containing repeated directory traversal sequences or attempts to access sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block HTTP requests that contain directory traversal characters, effectively providing a virtual patch for the vulnerable endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists via the Exploit-DB entry 47773.

Given the high CVSS severity and the availability of a public proof-of-concept, this vulnerability poses a credible threat to any exposed Bullwark Momentum Series JAWS instances. Organizations must prioritize restricting access to the affected interface and implementing robust WAF rules to prevent unauthorized file access while awaiting a permanent resolution from the vendor.