CVE-2022-22771

What it actually does

Allows authenticated web users to traverse directories and read arbitrary files on the underlying host system via crafted requests to the server component.

Why it matters to the business

Attackers could access sensitive configuration files, credentials, or other data stored on the server, leading to potential compromise of the reporting system and connected data sources.

How an attack unfolds

An attacker with valid low-privilege access to the JasperReports Server sends specially crafted HTTP requests containing directory traversal sequences to access files outside the intended web root.

How to fix it

Upgrade TIBCO JasperReports Server and Library components to versions beyond the affected 7.9.0 and 7.9.1 releases and apply any available security patches.

How to confirm the fix worked

Review server version information and test endpoints with known traversal payloads to confirm blocking of access to host files.

Typical attack path

1. Obtain valid user credentials for the reporting server
2. Identify vulnerable endpoints handling report resources
3. Craft and send requests with path traversal payloads like '../' sequences
4. Read sensitive host files such as /etc/passwd or application configs

How to detect it

Examine web server access logs for requests containing sequences like '../' or '..\' targeting report resources; look for successful responses returning file contents not related to reports.

• HTTP requests containing '../' or '..\' sequences to JasperReports endpoints
• Successful responses serving contents from host paths such as /etc/ or C:\Windows\

What your security team should do

• Prioritize upgrade of all affected TIBCO JasperReports instances to versions after 7.9.1
• Restrict network access to the server to trusted sources only
• Monitor logs for unusual file access patterns or traversal attempts
• Implement web application firewall rules to block directory traversal sequences