Horizon Alert
Summary of the vulnerability and why it matters
A configuration error in Suprema BioStar 2 can allow unauthorized access to sensitive backup files, potentially leading to server impersonation and unauthorized data access. This issue arises when backup file paths are incorrectly exposed through the web server.
- Sensitive backups can be publicly accessed.
- Confirms the need to review access controls.
- Focus on confirming relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker with network access can exploit a critical permission misconfiguration in Suprema BioStar 2. If an administrator incorrectly places backup file paths within the NGINX webroot, these sensitive ZIP files become publicly downloadable via HTTP(S) without any authentication. This exposure allows attackers to steal sensitive information, potentially leading to server impersonation, unauthorized database access, and further network compromise.
- Network access required to reach server.
- Publicly downloadable backup files via HTTP(S).
- Sensitive data exposure, server impersonation, and lateral movement.
Live Threat
Current exploitation, exposure, and threat context
Incorrect permission settings could expose critical backup files when the administrator configures their path within the NGINX webroot. This allows attackers with network access to download these files directly, potentially leading to server impersonation, unauthorized access to databases, and lateral movement.
- Sensitive backup files.
- Public download via webroot path.
- Server impersonation and database access.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts Suprema BioStar 2 deployments where administrator-configured backup file paths fall within the NGINX webroot. The first practical move is to identify all BioStar 2 instances, confirm their network exposure and criticality, and locate the accountable owner, likely an application or infrastructure team, to plan remediation based on risk.
- Application owners should address this issue.
- Verify backup file path configurations.
- Plan remediation during a maintenance window.
