Security risk - Possible Server Path Disclosure Pattern Found

Hi Syncfusion team,


Please assist in resolving this security issue of ej2.min.js from DASH result. Thanks.

* filename: ej2.min.js * version : 20.2.38



Regards,

Kuan Long


6 Replies

RS Ragunath Sukumaran Syncfusion Team September 16, 2022 01:51 PM UTC

Hi Kuan,


Greetings from Syncfusion support.


We have validated your reported query, and we found that this issue will occur on web server, when we refer a local file path in the application, because this will allow end users to traverse back or even attack your server. You can resolve this FPD issue, by changing a configuration in the web server, that is, by disabling the "directory browsing", and the method for doing so depends on which web server you are utilizing. Please refer these instructions for Apache and IIS, which are two of the more popular web servers and also every web server will have documentation that describes how to configure this setting.

If you are facing this issue only when referring the ej2.min.js of our Syncfusion file, then we are also providing a CDN link for this ej2.min.js file, we suggest you to refer this CDN in your application instead of using the local file, so that you can overcome this problem.


Please get back to us if you have any queries.


Regards,
Ragunath S



KL Kuan Long Khiu September 19, 2022 01:51 AM UTC

Hi Ragunath S,


Thanks for your prompt reply. We will try it.


Regards,

Kuan Long






KL Kuan Long Khiu September 19, 2022 03:55 AM UTC

Hi Ragunath S,


Unfortunately,  Our "Directory browsing" in IIS settings is already disabled. Moreover, the application cannot refer to CDN link as it's running in private cloud.


Regards,

Kuan Long



RS Ragunath Sukumaran Syncfusion Team September 21, 2022 03:02 PM UTC

Hi Kuan,


We have created a new ticket under your account to follow up with this query. We suggest you to follow up with the ticket for further updates. Please login using the below link.

https://support.syncfusion.com/support


Regards,
Ragunath S



KL Kuan Long Khiu September 22, 2022 01:36 AM UTC

Hi  Ragunath S,


Thanks for creating a new support ticket.


Regards,

Kuan Long



TJ Theveshwar Jayakumar Syncfusion Team September 22, 2022 08:40 AM UTC

Welcome! you can follow the above ticket for further assistance regarding this query.

Regards,

Theveshwar


Loader.
Up arrow icon