Eclipse BaSyx Java Server SDK vulnerabilities

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using MongoDB backend are vulnerable to unauthenticated arbitrary file write via the AAS thumbnail API. An attacker can upload a file with a controlled filename and then trigger retrieval, writing the content to any path on the server filesystem.

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. An attacker can supply a maliciously crafted fileName parameter during a file upload operation, allowing arbitrary files to be written to any location on the host filesystem.

In Eclipse BaSyx Java Server SDK prior to version 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI. An unauthenticated attacker can force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets, bypassing network segmentation.