Summary
Inspur Haiyue HCM Cloud contains a path traversal vulnerability in its model report file download functionality. An unauthenticated remote attacker may supply manipulated path parameters to read arbitrary files, including sensitive application and operating system data, when the endpoint is reachable.
Affected context
The vulnerability occurs in the /api/model_report/file/download endpoint when user-controlled index and ext parameters influence the file selected for download. Deployments may be at risk when this endpoint is externally reachable, does not require authentication, and fails to constrain file paths to an intended report directory.
Exploit preconditions
- Attack surface: HTTP-accessible model report file download endpoint
- Required access: No authentication may be required when the endpoint is exposed
- Trigger point: Processing of attacker-controlled file path parameters during a download request
- Why exploitation is possible: Input values are insufficiently validated or canonicalized before being used to resolve a filesystem path
Why this happens
The underlying bug is improper limitation of a path used to access local files. User-controlled path components are accepted without reliably enforcing an application-owned directory boundary, allowing traversal semantics to escape the intended storage location.
This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The insecure pattern occurs when request parameters are treated as trusted file locations instead of being resolved against a fixed base directory and checked after canonicalization.
Potential impact
- Attackers may read operating system files containing account or system information.
- Attackers could disclose application configuration and database files.
- Exposed secrets may enable follow-on access to connected services or administrative interfaces.
- Disclosure of internal paths and configuration may support additional attacks.
General mitigation guidance
Mitigation generally focuses on removing direct trust in client-supplied filesystem paths.
Common defensive patterns include:
- Map opaque file identifiers to server-side records rather than accepting path values from clients.
- Resolve candidate paths against a fixed, permitted directory and verify that the canonical result remains within that directory.
- Reject traversal syntax, absolute paths, unexpected separators, and encoded path variants as defense-in-depth controls.
- Apply strict allowlists for permitted file names and extensions.
- Require authentication and authorization for report downloads, using least privilege for the service account.
- Store downloadable artifacts outside sensitive filesystem locations and limit process access to only required directories.
- Avoid returning detailed filesystem errors or path information to clients.
How teams detect issues like this
High-level detection can combine source review, runtime monitoring, and policy enforcement:
- Use static analysis to identify request parameters passed into file-open, download, archive, or path-joining APIs.
- Review code for missing canonicalization, directory-boundary checks, allowlists, and authorization around file retrieval.
- Monitor web logs for unusual path separators, encoded traversal markers, absolute-path patterns, repeated download probing, and access to unexpected file names.
- Enforce application security policies requiring authenticated access and approved storage roots for file-download endpoints.
- Use automated code review or security scanning tools to flag direct use of request data in filesystem operations.
