BASIS BBj < 25.00 Unauthenticated Arbitrary File Read RCE
Vulnerability Description
BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service. Retrieved configuration artifacts may contain account credentials used for BBj Enterprise Manager; possession of these credentials enables administrative access and use of legitimate management functionality that can result in execution of system commands under the service account. Depending on the operating system and the privileges of the BBj service account, this issue may also allow access to other sensitive files on the host, including operating system or application data, potentially exposing additional confidential information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34320
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp.
- Omar Crespo, Pentester, GM Sectec, Corp.
Affected Vendor
BASIS International Ltd.
View all reports →