A10 Networks Loadbalancer Directory Traversal

`-----------  
Author:  
-----------  
  
xistence < xistence[at]0x90[.]nl >  
  
-------------------------  
Affected products:  
-------------------------  
  
A10 Networks Loadbalancer (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217  
  
-------------------------  
Affected vendors:  
-------------------------  
  
A10Networks  
http://www.a10networks.com/  
  
-------------------------  
Product description:  
-------------------------  
  
SupportCenter Plus is a web-based customer support software that lets  
organizations effectively manage customer tickets,  
their account & contact information, the service contracts and in the  
process providing a superior customer experience.  
  
----------  
Details:  
----------  
  
[ 0x01 - Directory Traversal ]  
  
A10 Networks (Soft)AX <=2.6.1-GR1-P5 & <=2.7.0 build 217 is prone to an  
unauthenticated directory traversal vulnerability.  
It's possible to download any file on the remote AX device with root  
privileges, without the need to authenticate to the website.  
  
The bug was fixed earlier in A10 Tracking ID "82150" according to the  
release notes, however the fix is not sufficient and can be bypassed.  
  
The new protection seems to make sure files are under the /a10data/tmp dir  
(https://<IP>/xml/downloads/?filename=/a10data/tmp/).  
  
By sending a GET request to  
"https://<IP>/xml/downloads/?filename=/a10data/tmp/../.."  
and thus keeping /a10data/tmp, we can bypass this. So if we would like  
to download the file /etc/shadow we send a GET request to "https://  
<IP>/xml/downloads/?filename=/a10data/tmp/../../etc/passwd".  
  
Or if we would like to download a certificate key file: "https://  
<IP>/xml/downloads/?filename=/a10data/tmp/../../a10data/key/domain.com"  
  
WARNING: Downloading a file will delete it from the AX device!  
  
  
-----------  
Solution:  
-----------  
  
Upgrade to a newer version.  
  
--------------  
Timeline:  
--------------  
  
Fixed somewhere back in 2013 :)  
`