Novell ZENworks Asset Management Path Traversal Exploit

This module exploits a path traversal vulnerability in Novell ZENworks Asset Management.



The flaw exists within the rtrlet component. This process listens on TCP port 8080. When handling an unauthenticated file upload the process does not properly sanitize the path. Directory traversal can be used to drop a file in an arbitrary location and a null byte inserted into the filename to provide arbitrary extension.