A critical path traversal vulnerability in Rocket Software TRUfusion Enterprise allows unauthenticated remote attackers to exfiltrate sensitive files, including system credentials.

The application fails to properly sanitize input provided to the /trufusionPortal/getCobrandingData endpoint. This allows an unauthenticated attacker to inject path traversal sequences and read sensitive files accessible to the application service account.

The ability for an unauthenticated attacker to read arbitrary files, specifically cleartext passwords used by the application, poses a catastrophic risk to data confidentiality and system integrity. With a CVSS score of 8.6, this vulnerability facilitates unauthorized access to sensitive supply chain data and administrative credentials, potentially leading to a full compromise of the affected environment.

Immediate Action: Update TRUfusion Enterprise to the latest version provided by Rocket Software that remediates the path traversal flaw in the getCobrandingData endpoint.

Proactive Monitoring: Review web access logs for suspicious requests containing directory traversal patterns, such as sequences of dots and slashes, directed at the /trufusionPortal/ endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests to the /trufusionPortal/getCobrandingData endpoint that contain path traversal characters or unexpected file access patterns.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up linked in the CVE references.

Given the high severity of this vulnerability and the availability of a public proof-of-concept, organizations should prioritize patching immediately. Failure to address this flaw leaves the application exposed to credential theft and unauthorized data access by unauthenticated remote actors.