| 标题 | alltena Trackplus Allegra 8.1.6 Remote Code Execution |
|---|
| 描述 | Note: The vendor has been notified and they have released a patch on 8.1.7 along with the advisory.
Description:
----------------
Remote code execution Via backup Restore feature.
Role Required: admin
Affected Version: latest(8.1.6) and lesser
Steps Of Reproduction
-----------------------
Exploit Steps:
------------------
1.Run the poc.py, this will generate a outer.zip file which will have a inner.zip file
2.head over to reports
3.Click on any report and click on add report, Give a name and upload the report
4.Try downloading the newly uploaded report this will give you the filename that will be used in future.
5.Head over to server configuration--->Other
6.change the database backup directory to /home/allegra/reportTemplates/<FILE_NAME_OF_NEWLY_DOWNLOADED_REPORT>
The /home/allegra/ could be different based on the home directory
7.Head over to db Restore
8.Fill out the Forms as shown on the poc.py
9.Ticket restore attachments
10.Put the attachment path as ../../../../../../../../../../../../../../../../../../../../../usr/local/tomcat/webapps/<CONTEXT_NAME>/js/
11.Click on start restore.
This would be quick.
Wait for like 30 seconds to a minute.
Navigate to http://<host>:<port>/<context>/js/trackdata/attachments/poc/poc.jsp?cmd=id
You can see , the id command has bee executed success Fully
Checkout the attach Video POC for more details.
Impact:
--------
Remote Code Execution that can lead to complete compromise of the environment.
CVSS:7.2
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
|---|
| 来源 | ⚠️ https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-7 |
|---|
| 用户 | w3bspl01t3r (UID 39229) |
|---|
| 提交 | 2025-10-08 20時54分 (1 年前) |
|---|
| 管理 | 2025-10-18 17時47分 (10 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 327654 [Alltena Allegra DatabaseBackupBL 目录遍历] |
|---|
| 积分 | 0 |
|---|