An authenticated file download vulnerability in Centova Cast 3.2.11 allows attackers to retrieve sensitive system files, posing a significant risk to server confidentiality.

This vulnerability involves a missing authorization flaw within the server.copyfile API endpoint. An authenticated attacker can supply crafted parameters to this endpoint to copy arbitrary files, such as /etc/passwd, to a location accessible via FTP, effectively bypassing standard file access restrictions.

The ability for an authenticated attacker to download arbitrary system files represents a high risk to organizational security. This unauthorized access can lead to the exposure of sensitive configuration files, credential hashes, or system information, which may be leveraged to facilitate further compromise of the underlying host. Given the CVSS score of 8.8, this flaw is considered high severity due to the potential for significant data exfiltration and loss of system integrity.

Immediate Action: Update Centova Cast to the latest available version provided by the vendor to remediate the insecure API endpoint.

Proactive Monitoring: Review application access logs for unusual activity targeting the server.copyfile API endpoint or unauthorized FTP access patterns.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the API endpoint and monitor for suspicious parameter inputs that attempt to traverse system directories.

Public Exploit Available: Yes, a functional exploit script is available via Exploit-DB (EDB-ID: 47669).

The severity of this vulnerability, combined with the availability of public exploit code, necessitates immediate attention. Administrators should prioritize patching their Centova Cast instances to eliminate the file download capability. If an immediate update is not feasible, restrict network access to the management interface to trusted internal IP addresses only.