CVE-2014-3914

What it actually does

Directory traversal in fileRequestor and userRequest servlets permits remote creation, reading, execution, and deletion of arbitrary files plus arbitrary code execution via crafted query parameters containing dot-dot sequences.

Why it matters to the business

Attackers can take complete control of the affected server, exfiltrate or destroy backup data, and persist on systems that remain unpatched after more than a decade, creating long-term operational and compliance exposure.

How an attack unfolds

An attacker sends specially crafted HTTP requests containing ../ sequences in the query parameter to the fileRequestor servlet (writeDataFile, readDataFile, run, runClear, del actions) or the userRequest servlet (save_server_groups action), bypassing path restrictions to manipulate or execute files on the underlying host.

How to fix it

Remove or isolate Rocket ServerGraph 1.2 instances; if the product is still required, restrict network access to trusted sources only and implement web-application firewall rules blocking directory traversal patterns, as no fixed versions are available.

How to confirm the fix worked

Confirm the Admin Center is not reachable from untrusted networks, review servlet request logs for traversal patterns, and verify that any remaining instances have been decommissioned or placed behind strict access controls.

Typical attack path

1. Identify exposed Rocket ServerGraph Admin Center endpoints
2. Craft HTTP requests with dot-dot sequences targeting fileRequestor or userRequest servlets
3. Upload or overwrite files, read sensitive data, or trigger execution of attacker-controlled content
4. Establish persistence or pivot using the resulting code execution

How to detect it

Inspect web-server and application logs for requests to fileRequestor and userRequest servlets containing writeDataFile, readDataFile, run, runClear, del, or save_server_groups actions with dot-dot sequences in query parameters; look for unexpected file creations or executions originating from the servlet process.

• writeDataFile
• readDataFile
• runClear
• save_server_groups
• ../
• fileRequestor
• userRequest

What your security team should do

• Immediately restrict or block external access to the Admin Center
• Search asset inventories for any remaining Rocket ServerGraph deployments
• Deploy WAF or network filtering rules to block traversal sequences in servlet parameters
• Plan migration away from the unsupported product