CVE-2020-35580 — AI Deep Analysis Summary

🚨 **Essence**: A Path Traversal vulnerability in SearchBlox. 📉 **Consequences**: Remote attackers can read arbitrary files from the OS. This includes sensitive config files and user password hashes.…

🛡️ **CWE**: Path Traversal / Local File Inclusion (LFI). 🔍 **Flaw**: The `FileServlet` fails to sanitize the `col=url` parameter.…

🏢 **Vendor**: SearchBlox. 📦 **Product**: SearchBlox Enterprise Search. 📅 **Affected Versions**: **Prior to version 9.2.2**. ✅ **Fixed**: Version 9.2.2 and later are safe. 🌐 **Scope**: Internal or Cloud deployments.

🕵️ **Privileges**: Remote, **Unauthenticated**. No login required! 🔓 **Data Access**: 1. Arbitrary OS files (e.g., `/etc/passwd`). 2. `searchblox/WEB-INF/config.xml`. 3. **Super Admin API Key**. 4.…

📉 **Threshold**: **LOW**. 🚪 **Auth**: None required. Unauthenticated access is sufficient. 🎯 **Config**: Simple URL manipulation. Just append `?col=url=` to the endpoint.…

📜 **Public Exp**: Yes. 🧪 **PoC**: Available via Nuclei templates (ProjectDiscovery). 🔗 **Link**: `https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35580.yaml`.…

🔍 **Self-Check**: Send a request to `/searchblox/servlet/FileServlet?col=url=`. 📤 **Indicator**: If the server returns file content (like `config.xml`) instead of an error, you are vulnerable.…

✅ **Fixed**: Yes. 🔄 **Patch**: Upgrade to **SearchBlox 9.2.2** or newer. 📥 **Action**: Check your current version immediately. 🏢 **Vendor**: Contact SearchBlox support for update instructions.…

🚧 **Workaround**: If patching is delayed, block external access to `/searchblox/servlet/FileServlet`. 🛑 **WAF**: Configure WAF rules to deny requests containing `../` in the `col` parameter.…

🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: High. ⚡ **Reason**: Unauthenticated access + Credential theft = Immediate risk. 📢 **Action**: Patch immediately or apply network restrictions. ⏳ **Time**: Do not delay.…