Path Traversal in Brocade Active Support Connectivity Gateway Enables Arbitrary File Write

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.

• Brocade Active Support Connectivity Gateway / Brocade ASCG: affected in versions before 3.5.0. The normalized record expresses this as version 0 with lessThan: 3.5.0, version type Brocade ASC-G, and default status unaffected outside the stated range.
• The Broadcom advisory lists Brocade ASC-Gateway OVA and Brocade Support Link in its product list, but its explicit affected statement identifies Brocade ASCG Standard deployment before 3.5.0. This does not independently establish exposure for other ASCG deployment branches or types.

The affected component is identified as ArchivesFiles, and the weakness is CWE-22 path traversal. During support bundle extraction, archive entry names can contain traversal sequences that are not sanitized before extraction. The attacker-controlled input is the archive file, specifically the entry paths within that archive. The described precondition is the ability to send or intercept an archive that ASCG will ingest from remote compromised endpoints; the supplied assessment states that authentication and user interaction are not required. A successful write can place arbitrary files in restricted locations on the underlying host and may lead to remote code execution. The available evidence does not specify the archive format, extraction library, destination paths, overwrite behavior, or which later process could execute a written file.

The supplied assessment classifies the attack vector as adjacent. An attacker must be able to send or intercept archives that the application will ingest from remote compromised endpoints. Authentication and user interaction are not required; the necessary condition is that an archive is available for processing, and the assessed attack complexity is low. The supplied record and the reviewed vendor advisory do not establish active exploitation or the availability of a public exploit.

The direct technical outcome is arbitrary file write to restricted locations on the underlying host. If the written file is configuration, data, or a component consumed by another service, an attacker could alter operation, disrupt service, or create conditions for remote code execution. Access to sensitive files may also be possible depending on the location and contents affected, but the evidence does not identify a data store, secret path, or specific execution mechanism. The record does not establish impact to independent downstream systems or that every successful file write results in code execution.

Successful exploitation could modify files on the gateway host outside the intended extraction scope, resulting in tampered configuration or altered service behavior. Depending on the targeted file and how other processes consume it, the incident could affect system confidentiality, integrity, and availability and may create a path to remote code execution. Because authentication is not required, the support-bundle ingestion trust boundary and the service's network placement are important operational controls. The record does not confirm successful code execution, data theft, persistence, or impact to separate downstream hosts.

1. Apply the security update in Brocade ASCG 3.5.0; this is the confirmed vendor solution for the affected branch.
2. Do not assume that a parallel branch or deployment type is fixed merely because an update exists for this branch. Confirm the status separately with vendor documentation if the system is not a Standard deployment.
3. If an immediate update is not possible, use an interim precaution by restricting or pausing ingestion of support bundle archives from untrusted or compromised endpoints and limiting adjacent-network access to the service where operationally feasible. The reviewed advisory does not document these measures as an official workaround.
4. After updating, recheck inventory, deployment type, and running version, then review for unusual file changes that occurred before the update.

1. Inventory Brocade ASCG deployments, identify the deployment type, verify the running release, and determine whether the system is a Standard deployment.
2. Identify systems that receive support bundle archives from remote endpoints, and verify the archive-processing and extraction component identified as ArchivesFiles.
3. Review host file integrity for unexpected file creation or modification around archive ingestion or extraction, especially changes outside the intended storage location.
4. Review archive-ingestion and extraction logs for unusual sources, processing errors, or activity outside the expected workflow. This is precautionary monitoring, not a vendor-confirmed IOC.
5. The reviewed material does not provide a specific IOC, log signature, endpoint, or destination path. The absence of relevant log evidence does not establish that a system is safe.