CVE-2026-11423

Executive Summary

CVE-2026-11423 is a critical path traversal vulnerability in Altium Enterprise Server’s Collaboration Service. An authenticated user can craft a malicious filename in a collaboration message, which is later used to construct a file download path without validation. This allows arbitrary file reads from the server filesystem, including the master configuration file that stores privileged credentials. Exploitation can lead to full administrative control of the server. Altium 365 cloud deployments are not affected. No public proof-of-concept or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires an authenticated user account.
• User Interaction (UI): None (N) – No user action needed beyond the attacker’s own.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full read access to server files, including credentials.
• Integrity (I): High (H) – Can modify server configuration after credential theft.
• Availability (A): High (H) – Can disrupt service or deploy ransomware.

CVSS Score: 8.8 (High) – Critical due to the potential for full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the Altium Enterprise Server Collaboration Service, specifically in the MCAD and Simulation file download flows. When a user submits a collaboration message, the server stores the message and its associated filename. Later, when another user requests to download the file, the server constructs the file path by concatenating a base directory with the stored filename. The flaw is that the filename is not sanitized for path traversal sequences (e.g., ../). An attacker can submit a filename like ../../../../etc/passwd or ../../../../Altium/Server/Config/master.config. When the download request is processed, the server reads the file at the traversed path and returns its contents to the attacker.

The master configuration file (master.config) contains credentials for privileged accounts (e.g., database, admin). With these credentials, the attacker can authenticate as a system administrator and gain full control of the server, including the ability to modify configurations, access all projects, and potentially pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation without validation
string basePath = "/var/altium/collaboration/files/";
string fileName = GetFileNameFromMessage(messageId); // e.g., "../../../etc/passwd"
string fullPath = Path.Combine(basePath, fileName); // Path.Combine does not prevent traversal
byte[] fileData = File.ReadAllBytes(fullPath);
return File(fileData, "application/octet-stream", fileName);

Patched Code (Conceptual):

// Patched: Validate and sanitize the filename
string basePath = "/var/altium/collaboration/files/";
string fileName = GetFileNameFromMessage(messageId);
// Reject any filename containing path traversal sequences
if (fileName.Contains("..") || fileName.Contains("/") || fileName.Contains("\\"))
{
    throw new SecurityException("Invalid filename");
}
// Alternatively, use Path.GetFileName to strip directory components
string safeFileName = Path.GetFileName(fileName);
string fullPath = Path.Combine(basePath, safeFileName);
if (!fullPath.StartsWith(basePath))
{
    throw new SecurityException("Path traversal detected");
}
byte[] fileData = File.ReadAllBytes(fullPath);
return File(fileData, "application/octet-stream", safeFileName);

Exploitation & Lab Setup

Red Team

Prerequisites:

• An authenticated user account on the Altium Enterprise Server.
• Network access to the Collaboration Service (typically port 9780 or 443).

Exploitation Steps:

1. Craft a malicious collaboration message with a filename containing path traversal sequences. For example:
   • ../../../../etc/passwd to read the system password file.
   • ../../../../Altium/Server/Config/master.config to read the master configuration.
2. Submit the message via the Collaboration Service API (e.g., POST to /api/collaboration/messages).
3. Trigger the download by requesting the file associated with the message (e.g., GET /api/collaboration/messages/{id}/file).
4. Parse the response to extract the file contents. If the master config is retrieved, extract credentials.
5. Authenticate as an administrator using the stolen credentials and gain full control.

Example API Call (cURL):

# Step 1: Submit a collaboration message with a malicious filename
curl -X POST https://target-server:9780/api/collaboration/messages \
  -H "Authorization: Bearer <user_token>" \
  -H "Content-Type: application/json" \
  -d '{"filename": "../../../../etc/passwd", "content": "dummy"}'

# Step 2: Retrieve the file (use the returned message ID)
curl -X GET https://target-server:9780/api/collaboration/messages/{message_id}/file \
  -H "Authorization: Bearer <user_token>" \
  -o /tmp/stolen_passwd

Blue Team

Detection Steps:

1. Monitor file access logs for unusual reads outside the collaboration directory (e.g., /etc/passwd, /Altium/Server/Config/master.config).
2. Inspect collaboration message filenames for path traversal patterns (../, ..\\, absolute paths).
3. Alert on repeated failed authentication attempts followed by successful admin login from the same IP.
4. Use the detection rules below to identify exploitation attempts.

Indicators of Compromise (IOCs)

• File paths accessed outside the collaboration directory:
  • /etc/passwd
  • /etc/shadow
  • /Altium/Server/Config/master.config
  • /Altium/Server/Config/database.config
• Collaboration messages with filenames containing ../ or ..\\.
• Unusual network connections from the server to external IPs after credential theft.
• New admin accounts created or unexpected changes to server configuration.
• Log entries showing Path traversal detected or Invalid filename (if patched).

Detection Engineering

YARA Rule

rule CVE_2026_11423_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Altium Enterprise Server collaboration filenames"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-11423"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "..%2f"
        $traversal4 = "..%5c"
        $config = "master.config"
        $passwd = "/etc/passwd"
    condition:
        any of ($traversal*) or any of ($config, $passwd)
}

Sigma Rule

title: CVE-2026-11423 - Altium Enterprise Server Path Traversal
id: 8a3f7c2e-1b4d-4f6a-9c8e-0d1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in Altium Enterprise Server collaboration file downloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: altium
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/collaboration/messages/*/file'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '..%2f'
            - '..%5c'
    condition: selection
falsepositives:
    - Legitimate use of filenames containing dots (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-11423 - Altium Enterprise Server Path Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/collaboration/messages/"; http_uri;
    content:"/file"; http_uri;
    pcre:"/(\.\.\/|\.\.\\|\.\.%2f|\.\.%5c)/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Collaboration Service if not essential, or restrict access to trusted IPs only.
2. Apply input validation on all filenames in collaboration messages – reject any containing ../, ..\\, or absolute paths.
3. Use a whitelist of allowed characters for filenames (e.g., alphanumeric, underscores, hyphens).
4. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in API requests.
5. Monitor logs for exploitation attempts and credential misuse.

Long-Term Fix:

• Vendor patch: Await an official patch from Altium. In the meantime, apply the conceptual fix described in the "Vulnerable vs. Patched Code" section.
• Upgrade to a version that includes proper path validation once released.
• Conduct a security audit of the Collaboration Service codebase for similar flaws.

Workaround:

• Use a reverse proxy (e.g., Nginx) to sanitize filenames before they reach the server:

  location /api/collaboration/messages/ {
      if ($args ~* "\.\.") {
          return 403;
      }
      proxy_pass http://backend;
  }
  

Valters IT
Securing Digital Frontiers