A critical path traversal vulnerability in Apache IoTDB allows unauthenticated attackers to write arbitrary files, potentially leading to full system compromise.

This is a path traversal vulnerability (CWE-22) residing in an unsafe API within Apache IoTDB. An unauthenticated remote attacker can exploit this flaw to overwrite or create arbitrary files on the underlying host, limited only by the permissions of the IoTDB process.

The ability to write arbitrary files provides an attacker with a direct path to remote code execution or persistent system modification. Given the CVSS score of 9.1, this vulnerability poses a severe threat to data integrity and system availability. Successful exploitation could lead to unauthorized configuration changes, deployment of malicious backdoors, or the destruction of critical operational data.

Immediate Action: Upgrade Apache IoTDB to version 2.0.10 or later immediately to resolve the unsafe API handling.

Proactive Monitoring: Monitor server logs for unusual file write operations, particularly those targeting system configuration directories or application binaries.

Compensating Controls: Deploy a Web Application Firewall (WAF) or Network Intrusion Detection System (NIDS) to identify and block traffic patterns indicative of path traversal attempts.

Public Exploit Available: False

The high CVSS score and the ability for unauthenticated exploitation make this a high-priority remediation item. Organizations running vulnerable versions of Apache IoTDB must prioritize the upgrade to version 2.0.10 to eliminate the risk of arbitrary file writes and potential system takeover.