CVE-2007-2285

This bug is like a “file address” form that doesn’t properly stop people from walking outside the folder they’re supposed to access. If someone finds the right request, they can trick the server into returning other files, not just the expected feed content. For a business, that can mean outsiders reading configuration files, stored data, or other sensitive information.

This matters if your small business website or app is still using Jack Slocum Ext 1.0 alpha1 (Ext JS) and that feed-proxy.php functionality is present. The findings indicate the attacker does not need a login to try to read files. Final reachability depends on whether the vulnerable feed-proxy.php endpoint is reachable over the network in your deployment (reachable from the internet and not blocked/disabled).

Treat this as an urgent patching/removal item because attackers can read arbitrary files remotely without authentication, and public exploit code exists. Even though this specific issue is old and not confirmed as listed in CISA KEV, the combination of unauthenticated file access and an available public exploit makes it high-risk for exposed deployments.

1. Confirm exposure in your codebase

   • Search your web application for Jack Slocum Ext 1.0 alpha1 and for the file examples/layout/feed-proxy.php.
   • Check how the feed parameter is passed into feed-proxy.php (look for query strings like feed=...).

2. Confirm exposure on the running site

   • Determine whether feed-proxy.php is reachable from outside the network (internet or untrusted clients).
   • If it’s behind authentication, note that this CVE is described as not requiring authentication, so confirm whether your routing actually prevents anonymous access.

3. Determine your upgrade/fix options

   • No fix/patch information is available for this CVE. That means there may not be a straightforward “upgrade to fixed version” path.
   • Plan to remove/disable the vulnerable component (feed-proxy.php functionality) and replace it with a safe alternative.

4. Temporary containment if you cannot remove immediately

   • Block direct external access to feed-proxy.php at the web server or application routing layer.
   • Add strong validation for the feed parameter to ensure it cannot contain traversal patterns (such as '..') and restrict it to an allowlist of expected values/paths.
   • Ensure error responses do not leak server filesystem paths.

5. Validate the result

   • After changes, verify that the endpoint cannot be used to fetch unexpected files.
   • Monitor web server logs for requests to feed-proxy.php with unusual feed parameter values.

6. Ongoing monitoring

   • Review logs for repeated probing of traversal patterns.
   • If you keep any feed proxying behavior, ensure it uses safe path handling and an allowlist approach.

CISA due date: not provided (this CVE is not listed in CISA KEV in the findings).

CVE-2007-2285 is a directory traversal weakness (CWE: NVD-CWE-Other) in examples/layout/feed-proxy.php from Jack Slocum Ext 1.0 alpha1 (Ext JS). The mechanism is that user-controlled input in the feed parameter can include .. (dot dot), causing the server to access files outside the intended directory and return them to the requester. The findings state authentication is not required, and the capability is arbitrary file read with network attack vector.

Exploitation status: public exploit available (1 known), so the vulnerability is realistically weaponized.

Patch status: no fix/patch information is available for this CVE.

Platform dependency: third-party analysis (from the provided backstop) suggests the issue might be platform dependent, so confirm behavior in your specific environment—but because the exploit is public, you should treat exposure as real if the code is reachable.

KEV: not listed in CISA KEV. EPSS is provided as a prediction, but it should not override the practical risk indicated by public exploit availability.