Rockwell Automation ThinManager ThinServer v13.1.0.2630 Multiple Vulnerabilities

CVE-2023-2917 - Message 38 (SYNC_MSG_SEND_FILE_BACKGROUND) Path Traversal File Upload

A client message sent to a synchronization thread in ThinServer.exe has the following structure:

// be = big endian
struct header
{
   be16 type;  // msg type
   be16 flags; // msg flags
               // 0x0001 - request
               // 0x0002 - response
               // 0x0020 - final msg fragment?
               // 0x8000 - ?
   be32 len;   // msg body length
};
struct msg
{
   header hdr; 
   byte data[hdr.len]; …