Executive brief
SOLIDserver IPAM is a DNS, DHCP, and IP address management appliance used by enterprises to manage and automate network infrastructure. A directory traversal vulnerability allows authenticated administrators to access and list files outside their authorized directories, potentially exposing sensitive network configuration data stored on the system.
Technical details
The vulnerability is a directory traversal flaw in the AJAX endpoint '/mod/ajax.php?action=sections/list/list' where the 'directory' parameter fails to properly validate and sanitize user input. An authenticated user with administrator privileges can manipulate the 'directory' parameter (e.g., setting it to '/') to traverse outside the restricted 'LOCAL:///' folder and access arbitrary directories on the system. The attack requires valid administrator credentials and network access to the management interface. Exploitation allows an attacker to enumerate and potentially read files and directory structures they should not have access to, compromising confidentiality of stored configuration and administrative data.
Affected products
- EfficientIP SOLIDserver IPAM v8.2.3
Timeline
- 2025-12-02: disclosed