CVE-2019-8358 : Security Advisory and Response

In versions prior to Hiawatha 10.8.4, an external attacker has the capability to perform directory traversal attacks if the AllowDotFiles feature is activated.

Understanding CVE-2019-8358

In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.

What is CVE-2019-8358?

CVE-2019-8358 is a vulnerability in Hiawatha web server versions prior to 10.8.4 that allows external attackers to conduct directory traversal attacks when the AllowDotFiles feature is turned on.

The Impact of CVE-2019-8358

This vulnerability could lead to unauthorized access to sensitive files and directories on the server, potentially compromising the confidentiality and integrity of data.

Technical Details of CVE-2019-8358

Vulnerability Description

Type: Directory Traversal
Attack Vector: Remote
Complexity: Low
Privileges Required: None

Affected Systems and Versions

Systems running Hiawatha web server versions prior to 10.8.4

Exploitation Mechanism

Attackers exploit the vulnerability by manipulating directory traversal sequences in URLs to access files and directories outside the web server's root directory.

Mitigation and Prevention

Immediate Steps to Take

Update Hiawatha web server to version 10.8.4 or newer.
Disable the AllowDotFiles feature if not required.

Long-Term Security Practices

Regularly monitor and audit web server logs for suspicious activities.
Implement network segmentation to limit the impact of potential breaches.

Patching and Updates

Stay informed about security updates and patches released by Hiawatha.