Security advisory: Web Service Document Upload Manager

From KnowledgeTree Community

Contents 1 Description 2 Affected Installations 3 How to resolve this issue 4 Support

Description

Authenticated Web Service users uploading a document via the KnowledgeTree Web Services Document Upload Manager are able to upload files to the filesystem outside of the KnowledgeTree var/uploads directory sandbox.

Filesystem write access is restricted to paths that the IIS or Apache Web Server service user has access to. That is, if your IIS or Apache web server is running as an unprivileged user, filesystem access is limited. Standard stack installations of KnowledgeTree utilize an unprivileged Web Server user.

Access to the Document Upload Manager is restricted to KnowledgeTree users authenticated with KnowledgeTree's SOAP or REST Web Services APIs.

Affected Installations

3.7.0.2

3.6.x

3.5.x

How to resolve this issue

To resolve this issue, please perform the following steps:

1) Locate and backup the following file:
<KnowledgeTree Directory>/knowledgeTree/ktwebservice/KTUploadManager.inc.php

2) Replace the file with the version available at the following address:
http://kt-download.s3.amazonaws.com/customer-files/KTUploadManager.inc.zip

3) If running version 3.7.0.2 on Zend Server, restart the Apache or IIS server to clear the Zend Data Cache. 

This application patch restricts Document Upload Manager filesystem access to the KnowledgeTree Uploads directory, var/uploads.

Support

Please email any questions regarding this issue to support@knowledgetree.com.