Known Issue: FME Server vulnerability with arbitrary path traversal and file upload

This known issue affects all versions of FME Server. Public-facing FME Server instances, including FME Cloud, are at higher risk. We have not identified any active exploitation of these vulnerabilities in any of our products.

Symptom

CVE-2022-38340 [NIST High severity]: An administrator user can write files to any location on the server drive hosting the FMEServer, which could result in unintended or malicious file uploads.

Cause

When a request to upload a file is made, the opt_namespace value is used to construct a portion of the file path; however, if this is not set or is blank, there are no validation checks for illegal characters performed.
 

Resolution 

Upgrade FME Server to 2021.2.6, 2022.0.1, or newer where this issue has been resolved. See the Downloads page for the latest version and our documentation for upgrading instructions. If you need assistance upgrading, please contact one of our Partners. 

Recognition 

Safe would like to thank Cycura Data Protection Corp. for making this responsible disclosure to us and recognize their contribution to increasing the security standard of FME.

Reporting Security Issues

If you believe you have discovered a vulnerability in FME, our website, or our other products, please email us as quickly as possible at  security (at) safe (dot) com.

We greatly appreciate the efforts of security researchers and discoverers who share information on security issues with us, giving us a chance to improve our products and better protect our users.

Please note that we do not compensate individuals or organizations for identifying potential or confirmed security vulnerabilities.