A critical path traversal vulnerability in HelloWeb 2.0 allows unauthenticated remote attackers to download arbitrary files from the host system, posing a severe risk of sensitive data exposure.

This is an arbitrary file download vulnerability (CWE-22) triggered by sending crafted GET requests to the download.asp endpoint. An unauthenticated attacker can manipulate the filepath and filename parameters to bypass directory restrictions and access sensitive configuration files on the server.

The ability for an unauthenticated user to download arbitrary system files can lead to the full compromise of the application environment. By accessing configuration files, an attacker can obtain database credentials, API keys, or other sensitive environmental variables, leading to unauthorized system access and potential data breaches. With a CVSS score of 7.5, this vulnerability represents a high risk to the confidentiality and integrity of the affected infrastructure.

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /exec/file/download.asp endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the download.asp file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests to download.asp that contain suspicious path manipulation characters or attempts to access restricted system files like web.config.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID 48659).

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any organization running HelloWeb 2.0. Administrators must prioritize isolating the vulnerable component immediately, as the lack of a vendor patch necessitates the implementation of strict network or application-level access controls to prevent unauthorized file access.