| Título | GiantappMan LiveWallPaper 2.6.8.0 Remote Code Execution (RCE) |
|---|
| Descripción | GiantappMan LiveWallPaper x.x.x.x for Windows exposes an ASP.NET Core Kestrel and SignalR management service on TCP port 5001. In the tested configuration, the service listened on x.x.x.x:5001 and was reachable from another host on the local network. The /livewallpaper SignalR hub and /LiveWallpaper/UploadFile endpoint did not require authentication.
An unauthenticated client can obtain a writable wallpaper draft directory via the hub, upload an executable file to it, and invoke ShowWallpaper with that file's path. The engine passes the path to a process launcher. In a test of the Microsoft Store build x.x.x.x on Windows 11 x64, a benign uploaded executable opened a distinct console window on the affected desktop and displayed the running user, host name, and working directory. Invoking the same method with the existing Windows Calculator executable also opened Calculator. The spawned process ran as the logged-on desktop user; no privilege elevation was demonstrated.
This issue is classified primarily as CWE-306 (Missing Authentication for Critical Function), with unrestricted upload of an executable (CWE-434) as a contributing weakness. The proposed CVSS v3.1 base score is 9.8 (Critical): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. AV:N reflects the HTTP/WebSocket listener observed on x.x.x.x:5001 with no protocol-level same-subnet requirement; it does not imply public-Internet exposure. The process runs with the existing desktop user's authority, so Scope is Unchanged. Only version x.x.x.x was independently verified; the status of other versions and a fixed release are unknown. The vendor's v2.x source at commit aa9bb36e342a86ddeab756ee27bde71290216d1a contains the listener, hub, upload handler, and process-launch code. A sanitized transcript and benign proof program are available for review. |
|---|
| Fuente | ⚠️ https://jfyuhong.github.io/advisories/livewallpaper-x.x.x.x/ |
|---|
| Usuario | JFyuhong (UID 101678) |
|---|
| Sumisión | 2026-09-27 10:54 (hace 28 días) |
|---|
| Moderación | 2026-10-25 09:22 (28 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 426178 [GiantappMan LiveWallPaper 2.6.8.0 en Windows SignalR Hub UploadFile autenticación débil] |
|---|
| Puntos | 20 |
|---|