| शीर्षक | alltena Trackplus Allegra 8.1.6 Remote Code Execution |
|---|
| विवरण | Note: The vendor has been notified and they have released a patch on 8.1.7 along with the advisory.
Description:
----------------
Remote code execution Via backup Restore feature.
Role Required: admin
Affected Version: latest(8.1.6) and lesser
Steps Of Reproduction
-----------------------
Exploit Steps:
------------------
1.Run the poc.py, this will generate a outer.zip file which will have a inner.zip file
2.head over to reports
3.Click on any report and click on add report, Give a name and upload the report
4.Try downloading the newly uploaded report this will give you the filename that will be used in future.
5.Head over to server configuration--->Other
6.change the database backup directory to /home/allegra/reportTemplates/<FILE_NAME_OF_NEWLY_DOWNLOADED_REPORT>
The /home/allegra/ could be different based on the home directory
7.Head over to db Restore
8.Fill out the Forms as shown on the poc.py
9.Ticket restore attachments
10.Put the attachment path as ../../../../../../../../../../../../../../../../../../../../../usr/local/tomcat/webapps/<CONTEXT_NAME>/js/
11.Click on start restore.
This would be quick.
Wait for like 30 seconds to a minute.
Navigate to http://<host>:<port>/<context>/js/trackdata/attachments/poc/poc.jsp?cmd=id
You can see , the id command has bee executed success Fully
Checkout the attach Video POC for more details.
Impact:
--------
Remote Code Execution that can lead to complete compromise of the environment.
CVSS:7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
|---|
| स्रोत | ⚠️ https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-7 |
|---|
| उपयोगकर्ता | w3bspl01t3r (UID 39229) |
|---|
| सबमिशन | 08/10/2025 08:54 PM (1 वर्ष पहले) |
|---|
| संयम | 18/10/2025 05:47 PM (10 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 327654 [Alltena Allegra DatabaseBackupBL निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 0 |
|---|