A path traversal vulnerability in NASA cFS v7.0.1 allows unauthenticated attackers to bypass access controls and read or manipulate sensitive filesystem locations.

The DS_SetDestPathCmd() function in the Data Storage application fails to validate the path field, allowing the use of directory traversal sequences like '../'. This allows an unauthenticated attacker to redirect file operations to arbitrary locations on the filesystem.

The CVSS score of 7.5 highlights the high risk associated with this flaw. Unauthorized access to sensitive components or the ability to overwrite critical data can lead to complete system compromise, data theft, or further exploitation of the underlying platform.

Immediate Action: Review the vendor advisory at https://github.com/nasa/cFS/issues/1072 and apply the recommended security updates as soon as they are provided.

Proactive Monitoring: Review application logs for path traversal attempts, specifically looking for '../' sequences in command parameters, and monitor for unauthorized file access attempts.

Compensating Controls: Ensure the application runs with the least privilege necessary, restricting the filesystem access of the DS component to only those directories essential for its operation.

Public Exploit Available: No

This vulnerability presents a significant risk to data confidentiality and integrity. Organizations should prioritize the implementation of the vendor's forthcoming fixes and ensure that current security configurations restrict filesystem access for the vulnerable component.