A critical unauthenticated arbitrary file read and write vulnerability in TEN Framework allows attackers to execute arbitrary code on the host system.

This vulnerability involves a lack of authentication for critical API endpoints within the TMAN Designer module. Specifically, the get_file_content_endpoint and save_file_content_endpoint functions fail to verify user credentials, allowing unauthenticated attackers to read or overwrite sensitive system files.

The ability for an unauthenticated attacker to write arbitrary files to the filesystem poses a severe risk to business operations and data integrity. By modifying system files such as authorized keys or cron jobs, an attacker can gain full remote control of the server, leading to complete system compromise, data exfiltration, or unauthorized lateral movement. Given the CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent catastrophic failure.

Immediate Action: There is currently no specific patch version listed, so administrators should restrict access to the TMAN Designer API endpoints at the network level immediately.

Proactive Monitoring: Review web server and application logs for suspicious POST or PUT requests targeting the /api/designer/v1/file-content path, specifically monitoring for unusual file path arguments.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block all requests to the /api/designer/v1/file-content endpoint unless originating from a trusted, authorized management IP address.

Public Exploit Available: Unknown

This vulnerability represents a critical security failure due to the absence of authentication on sensitive administrative endpoints. Given the potential for full remote code execution, organizations must prioritize isolating the affected component from public-facing networks. Until a vendor-supplied patch is available, strict network-level access control is the only effective method to mitigate the risk of exploitation.