A critical permission bypass flaw in OpenHarness allows unauthenticated remote attackers to access sensitive system files and configuration data.

This vulnerability involves incorrect authorization (CWE-863) where incomplete path normalization allows unauthenticated users to bypass restrictions. Attackers can trigger the built-in grep and glob tools to target sensitive root directories that are not correctly validated against established path rules.

The ability for an unauthenticated attacker to read arbitrary files poses a severe risk to confidentiality. This may lead to the exposure of cryptographic key material, sensitive configuration files, and proprietary system data, which could facilitate further compromise of the environment. With a CVSS score of 7.5, this vulnerability represents a high-severity threat that necessitates immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update OpenHarness to the commit version bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae or later to ensure proper path normalization and authorization checks are enforced.

Proactive Monitoring: Review system and application access logs for unusual grep or glob command executions originating from external or unauthorized sources.

Compensating Controls: Implement strict network segmentation and apply Web Application Firewall rules to block requests containing suspicious path traversal patterns or unauthorized attempts to access system directories.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for direct access to sensitive file system content, organizations must prioritize upgrading their OpenHarness deployment. Verify the integrity of your current version and apply the identified fix immediately to secure the environment against potential unauthorized information disclosure.