CVE-2016-6598 in Track-It!
Summary
by MITRE
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web root and achieve code execution as NETWORK SERVICE or SYSTEM.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/28/2025
The vulnerability described in CVE-2016-6598 represents a critical security flaw in BMC Track-It! version 11.4 prior to Hotfix 3, where an unauthenticated .NET remoting file storage service is exposed on port 9010. This service operates using the FileStorageService component which provides remote file upload capabilities without proper authentication mechanisms. The flaw stems from the service's design allowing any external attacker to connect and invoke file upload operations without requiring valid credentials or access controls. The service exposes functionality that permits arbitrary file placement on the target system, creating a fundamental breach in the application's security model. This exposure occurs at the network level where the service listens on a well-known port, making it easily discoverable and exploitable by threat actors without requiring any prior access to the system.
The technical exploitation of this vulnerability involves leveraging the unauthenticated .NET remoting interface to send crafted requests that invoke the file upload method. The service accepts file uploads to arbitrary paths on the filesystem, which means attackers can target any location where the service has write permissions. When combined with the fact that Track-It! typically runs with elevated privileges such as NETWORK SERVICE or SYSTEM accounts, successful exploitation can result in complete system compromise. The attack chain begins with network reconnaissance to identify the exposed service, followed by crafting malicious payloads that can be uploaded to the web root directory or other critical system locations. The vulnerability directly maps to CWE-284 Access Control Issues, specifically involving insufficient access control for remote file operations. This weakness allows unauthorized users to manipulate system files and potentially escalate privileges to the highest available level.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with a direct path to code execution on the target system. Once an attacker successfully uploads a malicious file to the web root directory, they can execute arbitrary code with the privileges of the Track-It in production environments, potentially exposing sensitive business data and creating opportunities for further attacks. The impact extends beyond the immediate system compromise, as attackers can use the compromised system as a foothold for broader network infiltration and privilege escalation attacks.
The primary mitigation strategy involves applying the official BMC Hotfix 3 patch that addresses this specific vulnerability by implementing proper authentication controls for the FileStorageService. Organizations should also consider network segmentation to restrict access to port 9010, implementing firewall rules that limit connections to only authorized systems. Additionally, regular security assessments should be conducted to identify other exposed services that may present similar vulnerabilities. The remediation process should include disabling the FileStorageService if it is not required for business operations, as well as implementing proper access controls and monitoring for unauthorized file upload activities. This vulnerability highlights the importance of following the principle of least privilege and ensuring that all network services implement proper authentication mechanisms. Organizations should also consider implementing network detection capabilities to identify and alert on suspicious file upload activities that may indicate exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1190 Exploit Public-Facing Application and T1059 Command and Scripting Interpreter, emphasizing the need for comprehensive defensive measures including network monitoring, access control enforcement, and regular patch management procedures.