CVE-2016-20023

Executive Summary

CVE-2016-20023 is a path traversal vulnerability in CKSource CKFinder for ASP.NET, affecting versions prior to 2.5.0.1. An authenticated attacker can exploit this flaw to download arbitrary files from the server by manipulating the file path parameter. The vulnerability has a CVSS score of 5.0 (Medium) and a low EPSS probability of 0.0%, indicating it is not currently being widely exploited in the wild. However, given the lack of a public patch for many legacy deployments, it remains a significant risk for organizations using outdated versions of this file manager.

Supply Chain & Package Security

This vulnerability affects a third-party ASP.NET component (CKFinder) distributed by CKSource. Organizations using CKFinder as part of a larger web application should verify the version in use and ensure it is updated to 2.5.0.1 or later. Since CKFinder is often bundled with content management systems or custom applications, supply chain risk is elevated if the component is not independently tracked and updated.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (arbitrary file read)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the requirement for authentication, but the potential for reading sensitive files (e.g., web.config, database connection strings) makes it a serious concern for internal networks or applications with weak authentication.

Deep Dive & Mechanics

The vulnerability resides in the file download functionality of CKFinder for ASP.NET. The application fails to properly sanitize user-supplied file paths, allowing an authenticated attacker to traverse directories using ../ sequences. By crafting a request with a path like ../../../etc/passwd or ../../../web.config, the attacker can read arbitrary files outside the intended upload directory.

The root cause is a lack of input validation and path canonicalization. The application likely uses a simple string concatenation or a non-secure path resolution method, enabling directory traversal.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.5.0.1):

// Example of vulnerable path handling
string filePath = Path.Combine(baseDirectory, userProvidedPath);
// No validation of userProvidedPath for traversal sequences
Response.TransmitFile(filePath);

Patched Code (2.5.0.1+):

// Example of patched path handling
string userPath = userProvidedPath;
// Remove any traversal sequences
userPath = userPath.Replace("..", "");
// Or use GetFullPath to canonicalize and then validate
string fullPath = Path.GetFullPath(Path.Combine(baseDirectory, userPath));
if (!fullPath.StartsWith(baseDirectory))
{
    throw new SecurityException("Invalid path.");
}
Response.TransmitFile(fullPath);

The patch introduces path canonicalization and a check to ensure the resolved path remains within the allowed base directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid authenticated session to CKFinder.
• Knowledge of the target file path (e.g., web.config, App_Data/database.mdf).

Exploit Steps:

1. Log in to CKFinder.
2. Intercept a file download request (e.g., using Burp Suite).
3. Modify the path or file parameter to include directory traversal sequences.
   • Example: path=../../../web.config
4. Send the request and observe the response containing the file content.

Proof-of-Concept (PoC) Request:

GET /ckfinder/core/connector/aspnet/connector.aspx?command=Download&type=Files&currentFolder=/&fileName=../../../web.config HTTP/1.1
Host: target.com
Cookie: ASP.NET_SessionId=valid_session

Blue Team

Detection:

• Monitor for requests containing ../ or ..\ in file download parameters.
• Alert on attempts to access files outside the expected upload directory (e.g., web.config, bin/, App_Data/).

Hunting:

• Search web server logs for patterns like fileName=.. or path=.. in CKFinder connector requests.
• Correlate with authenticated sessions to identify potential exploitation.

Lab Setup:

• Deploy a vulnerable CKFinder instance (version < 2.5.0.1) on a local IIS server.
• Create a test user and upload a sample file.
• Use the PoC above to verify the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to CKFinder connector with fileName or path parameters containing ../ or ..\.
  • Unusual file download requests for system files (e.g., web.config, machine.config, boot.ini).

• File System IOCs:

  • Unexpected access to files outside the CKFinder upload directory.
  • Presence of downloaded sensitive files in temporary directories.

• Log IOCs:

  • Web server logs showing 200 responses for requests with traversal sequences.
  • Application logs with errors related to path resolution or file access.

Detection Engineering

YARA Rule

rule CVE_2016_20023_CKFinder_PathTraversal {
    meta:
        description = "Detects path traversal attempts in CKFinder for ASP.NET"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2016-20023"
    strings:
        $traversal = /\.\.(\/|\\)/
        $ckfinder = "ckfinder" nocase
        $connector = "connector.aspx" nocase
    condition:
        $ckfinder and $connector and #traversal > 0
}

Sigma Rule

title: CKFinder Path Traversal Attempt
id: 8f7b3c2a-1d5e-4f9a-8c6b-3e2a1d5f9c8b
status: experimental
description: Detects path traversal attempts in CKFinder for ASP.NET (CVE-2016-20023)
author: Valters IT
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - '..'
            - '%2e%2e'
        cs-uri-stem|contains:
            - 'ckfinder'
            - 'connector.aspx'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2016-20023 CKFinder Path Traversal Attempt"; flow:to_server,established; content:"ckfinder"; nocase; content:"connector.aspx"; nocase; pcre:"/\.\.(\/|\\)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade CKFinder for ASP.NET to version 2.5.0.1 or later.
2. Compensating Controls:
   • Implement a Web Application Firewall (WAF) rule to block requests containing ../ or ..\ in file download parameters.
   • Restrict CKFinder access to trusted IP ranges or enforce strong authentication.
   • Monitor and audit file download requests for anomalous patterns.
3. Long-term:
   • Conduct a security review of all third-party components in the application.
   • Implement input validation and path canonicalization in custom code.
   • Use a vulnerability scanner to identify outdated components.

Valters IT
Securing Digital Frontiers