LogicalDOC Enterprise 7.7.4 多个身份验证后目录遍历漏洞

攻击者可以利用此漏洞访问 LogicalDOC Enterprise 服务器上的敏感系统文件。通过修改 /thumbnail 和 /convertpdf 端点的 suffix 和 fileVersion 参数，攻击者可以读取诸如 win.ini 和 /etc/passwd 等文件。这可能导致信息泄露，甚至可能允许攻击者进一步控制受影响的系统。如果攻击者能够访问数据库凭据或其他敏感配置信息，他们可能会实现横向移动，并访问网络中的其他资源。该漏洞的潜在影响范围取决于 LogicalDOC Enterprise 在网络中的部署方式以及其访问到的数据的敏感程度。

Organizations utilizing LogicalDOC Enterprise for document management, particularly those with older versions (7.1.1 – 7.7.4), are at risk. Shared hosting environments where multiple users have access to the LogicalDOC Enterprise instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit this vulnerability.

• windows / other: Monitor event logs for unusual file access attempts, particularly targeting files outside of the LogicalDOC Enterprise application directory. Use Sysinternals Process Monitor to observe file system activity related to the LogicalDOC Enterprise process. • linux / server: Examine auditd logs for attempts to access files outside the expected directories. Use lsof to identify processes accessing sensitive system files. • generic web: Inspect access logs for requests to /thumbnail and /convertpdf endpoints with unusual or excessively long parameters. Look for patterns indicative of path traversal attempts.

1. 2025-12-24Disclosure

   disclosure

1. 已保留2025-12-24
2. 发布日期2025-12-24
3. 修改日期2026-03-05
4. EPSS 更新日期2026-03-23

最有效的缓解措施是升级 LogicalDOC Enterprise 至 7.7.5 或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：限制对 /thumbnail 和 /convertpdf 端点的访问，仅允许授权用户访问。实施严格的输入验证，以防止路径遍历攻击。使用 Web 应用防火墙 (WAF) 规则来检测和阻止恶意请求。监控 LogicalDOC Enterprise 日志，以查找可疑活动。在升级后，验证漏洞是否已成功修复，例如尝试访问已知敏感文件，并确认无法访问。