CVE-2019-6268

Path Traversal: 'dir\..\..\filename' (CWE-31)

Published: Mar 8, 2024 / Updated: 8mo ago

We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it’s believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.

We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it’s believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.

We know the list of Snowflake victims is long – at least 165 targets were caught up in the security failure, threat hunters at Mandiant reported recently – including, it's believed after news broke this week, Australian ticketing provider Ticketek. US car part retailer Advance Auto Parts was also believed to be a Snowflake victim, which the company confirmed last week in a filing with the US Securities and Exchange Commission.

On Tuesday in my CISA advisory post on Substack, I included a down-the-rabbit-hole (DTRH) look at the delay between the apparent 2019 discovery (per the CVE number - CVE-2019-6268) of the path traversal vulnerability reported by CISA on Tuesday and the publication of an exploit earlier this year. I contacted Branko Milicevic, the researcher who originally identified the vulnerability and published the exploit, to find out the classic ‘rest of the story’. For more details about that ‘rest of the story’, see my article on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/rabbit-hole-update - subscription required.

The advisory, issued on June 18, 2024, highlights a significant security flaw in RAD Data Communications’ SecFlow-2 devices, which could be exploited remotely with low attack complexity. The Cybersecurity and Infrastructure Security Agency (CISA) has released a new advisory concerning a critical vulnerability in industrial control systems (ICS).