CVE-2024-28064

The Totemomail application exposes an endpoint /responsiveUI/EnvelopeOpenServlet that accepts a messageId parameter without proper path validation and sanitization. An attacker can pass a specially crafted parameter value containing path traversal sequences (e.g., '../') to escape the allowed directory. Through the displayLoginChunkedImages operation, unauthorized file read and delete operations are possible, while the storeLoginChunkedImages operation enables unauthorized writing of arbitrary files to the system.

An unauthenticated attacker can read sensitive files from the server operating system, write arbitrary files (which may lead to server takeover, e.g., through webshell upload), and permanently delete files, causing service unavailability or data loss.

Kiteworks Totemomail must be immediately updated to version 8.3.0 or later. Until the patch is deployed, it is recommended to restrict network access to the vulnerable endpoint /responsiveUI/EnvelopeOpenServlet at the firewall or reverse proxy level.

Kiteworks Totemomail versions 7.x and 8.x prior to version 8.3.0