Horizon Alert
Summary of the vulnerability and why it matters
Metacat, a data repository software used by researchers, has a vulnerability that could allow unauthorized access to files. This issue affects older versions of Metacat and could potentially expose sensitive research data, credentials, and system information.
- Unauthenticated access to files is possible.
- Exposed data could compromise research integrity.
- Confirm relevance and assess exposure.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit this vulnerability by sending a crafted request to the Metacat API. This request would target the `action=read` endpoint, specifically manipulating the `archiveEntryName` parameter. Because the software does not properly validate this parameter, it can be used to trick Metacat into revealing sensitive files on the server that are accessible to the underlying process. This could lead to the disclosure of credentials, private keys, or confidential research data.
- Requires access to the vulnerable API.
- Triggered by an unauthenticated API request.
- Risk of credential and data exfiltration.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated path traversal vulnerability in Metacat's `action=read` endpoint could allow an attacker to read any file accessible to the Tomcat process. This could lead to the exposure of sensitive information such as credentials, client certificates, private keys, and embargoed research data, facilitating system reconnaissance and impersonation.
- Sensitive system and research data.
- Unauthenticated network access to read files.
- Credential theft and data disclosure.
Operational Fix
Recommended remediation, mitigation, and detection steps
The most likely teams responsible for addressing this vulnerability are the application owners who manage Metacat deployments and the infrastructure teams responsible for the underlying Tomcat or hosting environment. The first practical step is to identify all instances of Metacat, confirm their reachability and business criticality, and then locate the accountable owner for remediation planning.
- Application owners should manage the issue.
- Verify Metacat 1.x API endpoint exposure.
- Plan remediation or mitigation strategy.
