A10 Thunder ADC FileMgmtExport Directory Traversal Arbitrary File Read and Deletion Vulnerability

Successful exploitation of CVE-2023-42130 allows an attacker to bypass access controls and directly manipulate files on the Thunder ADC appliance. This includes sensitive configuration files, user credentials, and potentially application data. The ability to delete files could lead to denial of service or further compromise the system. Given the ADC's role in managing network traffic and application delivery, a successful attack could have a significant impact on the availability and integrity of services. The requirement for authentication limits the immediate blast radius, but a compromised user account could be leveraged to exploit this vulnerability.

Organizations utilizing A10 Thunder ADC appliances in production environments, particularly those with legacy configurations or shared hosting setups, are at risk. Environments where user authentication is not strictly enforced or where user accounts have excessive privileges are especially vulnerable.

• linux / server: Monitor A10 Thunder ADC logs for unusual file access attempts, particularly those involving the FileMgmtExport functionality. Use journalctl to filter for relevant events.

journalctl -u thunderadcd | grep "FileMgmtExport"

• generic web: Examine access logs for requests containing suspicious file paths or directory traversal sequences (e.g., ../).

grep '../' /var/log/apache2/access.log

• other: Review A10 Thunder ADC configuration for overly permissive file access permissions. Check for any unauthorized user accounts with elevated privileges.

1. 2024-05-03Disclosure

   disclosure

1. Reserviert2023-09-06
2. Veröffentlicht2024-05-03
3. Geändert2024-09-18
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2023-42130 is to upgrade to a patched version of A10 Thunder ADC. Refer to the A10 Networks advisory for the specific fixed version. If immediate patching is not possible, consider implementing stricter access controls to limit the number of authenticated users with access to the FileMgmtExport functionality. While a direct WAF rule is difficult to implement due to the nature of directory traversal, carefully reviewing and restricting file access permissions can reduce the attack surface. Monitor system logs for unusual file access patterns or deletion attempts.