IBM Aspera Desktop App Path Traversal Vulnerability

Technical Analysis

The vulnerability stems from insufficient validation of file paths within transfer manifests or metadata processed by the Aspera Desktop client, allowing crafted filenames (e.g., containing '../' sequences) to escape the intended download directory. An attacker able to influence the content or naming of transferred files—such as a malicious file source or a compromised Aspera server—could write files to arbitrary locations, potentially overwriting startup scripts, configuration files, or binaries to achieve persistence or code execution. The CVSS score of 9.3 reflects the high impact and relatively low complexity of exploitation, likely requiring only that a victim initiate or accept a file transfer from a malicious or compromised source. Organizations that use Aspera Desktop to transfer large datasets—including training data, model weights, or configuration files for AI/ML pipelines—could have agent hosts or RAG pipeline data stores compromised if malicious files are written into directories used by agent frameworks or automated ingestion scripts, enabling downstream code execution or data poisoning.

Affected Systems

IBM Aspera Desktop App versions 1.0.5 through 1.0.19 on Windows, macOS, and Linux platforms

Indicators of Compromise

• No specific IOCs published; monitor for anomalous file writes outside configured Aspera download directories
• Unexpected files in system directories following Aspera transfer sessions
• Aspera transfer logs referencing unusual or traversal-style filenames (e.g., containing ../ or absolute paths)

Remediation Steps

1. 1

   Upgrade Aspera Desktop App

   Update to the latest patched version of IBM Aspera Desktop App as specified in IBM's security advisory once available.

2. 2

   Restrict Transfer Sources

   Limit Aspera file transfers to trusted, authenticated servers and disable transfers from unverified or public endpoints.

3. 3

   Monitor File System Activity

   Deploy file integrity monitoring on systems running Aspera Desktop to detect unauthorized file writes outside designated download folders.

4. 4

   Apply Least Privilege

   Run Aspera Desktop under a restricted user account with minimal write permissions to reduce the blast radius of potential path traversal exploitation.

5. 5

   Isolate Automated Pipelines

   For environments where Aspera feeds data into automated ML/agent pipelines, sandbox the ingestion directory and validate all incoming file paths before processing.