Oliver Library Server v5 - Arbiträrer Dateidownload

Successful exploitation of CVE-2021-47755 allows an attacker to bypass authentication and directly download arbitrary files from the server. This includes configuration files, database backups, and potentially even source code, depending on the server's configuration and file permissions. The attacker's ability to access sensitive data could lead to data breaches, compromise of user credentials, and further system compromise. The lack of authentication requirements significantly broadens the attack surface, making the vulnerability particularly concerning. The potential for data exfiltration is high, and the attacker could use the obtained information for further reconnaissance or lateral movement within the network.

Organizations running Oliver Library Server, particularly those with publicly accessible instances or those lacking robust web application firewalls, are at risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as an attacker could potentially exploit this vulnerability to access files belonging to other users.

• linux / server:

journalctl -u oliver_library_server -g 'FileServlet' | grep -i 'fileName='

• generic web:

curl -I 'http://<server_ip>/oliver/FileServlet?fileName=<suspicious_filename>' | grep '200 OK'

1. 2026-01-15Disclosure

   disclosure

1. Reserviert2026-01-10
2. Veröffentlicht2026-01-15
3. Geändert2026-04-07
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2021-47755 is to upgrade Oliver Library Server to version 8.00.008.053 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters or patterns in the 'fileName' parameter. Additionally, restrict file permissions on the server to limit the attacker's access to sensitive files, even if they manage to bypass the FileServlet's intended functionality. Regularly review server logs for unusual file access attempts and implement intrusion detection system (IDS) rules to alert on suspicious activity.