A high-severity insecure direct object reference vulnerability in Rhymix allows authenticated attackers to access arbitrary files, posing a risk of unauthorized data exposure.

The application is vulnerable to CWE-425, also known as forced browsing, which allows an authenticated user with low privileges to access files outside of the intended directory structure. This flaw is triggered by manipulating extra variables within the application, effectively bypassing access controls.

The ability to access arbitrary files on the server can lead to the exposure of sensitive configuration files, source code, or user data. Given the CVSS score of 7.4, this vulnerability represents a significant risk to confidentiality and integrity, potentially allowing an attacker to escalate their access or facilitate further system compromise.

Immediate Action: Upgrade to Rhymix version 2.1.31 or later, as this release contains the necessary security fixes to remediate the file access vulnerability.

Proactive Monitoring: Audit web server access logs for requests containing suspicious directory traversal patterns or unusual access requests directed at extra variable parameters.

Compensating Controls: Implement strict file system permissions for the web server user and utilize a Web Application Firewall to filter and block requests that exhibit signs of directory traversal or unauthorized file path manipulation.

Public Exploit Available: No

The vulnerability identified in Rhymix poses a credible risk to the security of the host environment. Administrators must prioritize updating their installations to version 2.1.31 to eliminate the underlying flaw. Failure to patch may allow malicious actors to extract sensitive system information through direct object reference manipulation.