Wipro Holmes Orchestrator is an AI-powered automation platform used by enterprises in banking, healthcare, and utilities to streamline workflows and enhance decision-making. It integrates with existing systems via a robust API, enabling predictive analytics and operational efficiency. Multinational corporations rely on it for complex process orchestration, but its extensive functionality requires rigorous security oversight.
CVE-2021-38146 is an arbitrary file download vulnerability arising from improper input validation in the File Download API. The flaw allows absolute path traversal, enabling attackers to bypass access controls and retrieve sensitive files from the server. This occurs due to insufficient sanitization of user-supplied data before file path construction.
The vulnerability is exploited by sending a crafted POST request to the `/home/download` endpoint with a malicious `SearchString` JSON field. By manipulating this parameter, an attacker can specify arbitrary file paths, such as `/etc/passwd` or configuration files, leading to unauthorized data exposure. No authentication is required for exploitation.
Successful exploitation can result in the disclosure of sensitive data, including credentials, configuration files, and proprietary business information. This could lead to further attacks, such as lateral movement or privilege escalation, compromising the entire infrastructure. The CVSS score of 7.5 highlights the critical risk to confidentiality.
- Upgrade Wipro Holmes Orchestrator to version 21.4.0 or later, which includes the official patch for CVE-2021-38146.
- Implement strict input validation on the `SearchString` parameter to reject path traversal sequences like `../` or absolute paths.
- Apply the principle of least privilege to the file download functionality, restricting access to only necessary directories.
- Use a web application firewall (WAF) to block malicious requests targeting the `/home/download` endpoint.
- Conduct regular security audits and penetration testing to identify and remediate similar vulnerabilities.
- Monitor server logs for unusual file download patterns, such as attempts to access system files or repeated failures.
- Enforce network segmentation to limit the blast radius of a potential breach from the orchestrator server.
- Educate developers on secure coding practices, particularly around file path handling and input validation.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →