Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows an authenticated user to read arbitrary files from the server's local storage by manipulating file path parameters. Because this can expose sensitive server secrets like database credentials and signing keys, it could lead to a full compromise of the server and its data. Teams should pay attention because this could grant attackers access to critical secrets.
- Discloses server secrets.
- Allows server data compromise.
Attack Path
How an attacker could exploit the issue
An authenticated user could exploit this vulnerability in Altium Enterprise Server's Viewer component to read arbitrary files from the server. By manipulating path parameters in API requests, an attacker can bypass the storage root and access sensitive files like configuration or credentials. This could lead to full server compromise.
- Requires authenticated access.
- Targets Viewer API endpoint.
- Exploits path traversal flaw.
- Affects on-premise local storage.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows authenticated users to read arbitrary files from the server's filesystem, including critical secrets like database credentials and signing keys. While this offers a clear path to full server compromise, its exploitation is likely limited to insider threats or scenarios where an attacker has already gained a foothold within the network. Cloud deployments are not affected.
- Path traversal can expose server secrets.
- Exploitation requires authenticated access.
- Primarily an insider threat.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or isolating Altium Enterprise Server instances that use local filesystem storage, as exploitation can lead to full server compromise by revealing sensitive credentials and keys.
- Identify and inventory affected on-premise deployments.
- Block access to the Viewer Storage API or isolate the server.
- Apply vendor patches when available.
