A critical path traversal vulnerability in DbGate versions 7.2.6 and earlier allows authenticated attackers to read and write arbitrary files on the host system.

The vulnerability exists within the jsldata controller and the getJslFileName function, which fails to properly validate the jslid parameter. An authenticated user can supply a jslid string starting with the file:// scheme to bypass intended directory restrictions and interact with arbitrary files on the server.

Successful exploitation of this vulnerability allows an authenticated attacker to read sensitive configuration files, such as database credentials, or overwrite critical system files. This could lead to a complete compromise of the database management environment, unauthorized access to connected data sources, and potential remote code execution depending on the file targets. The high CVSS score of 8.8 reflects the severity of allowing arbitrary file system access within an application context.

Immediate Action: Update DbGate to the latest version, which includes patches to validate and restrict the jslid parameter. If an update is not immediately possible, restrict access to the DbGate instance to trusted users only.

Proactive Monitoring: Review application logs for any requests to the jsldata controller containing the file:// scheme or unusual path traversal patterns. Monitor for unexpected file modifications or unauthorized access attempts to sensitive configuration directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing the file:// scheme within the jslid parameter. Ensure that the service account running DbGate operates with the principle of least privilege, limiting its ability to access sensitive system files.

Public Exploit Available: No

Given the potential for total system impact, users should prioritize patching their DbGate installations immediately. The ability to read and write arbitrary files poses a significant risk to the integrity and confidentiality of the entire database infrastructure, necessitating prompt action to mitigate this high-severity flaw.