Junglewise Threat Intelligence

CVE-2016-6600: Zoho WebNMS Framework directory traversal in FileUploadServlet

CVE-2016-6600 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Vendors: Zoho.

Executive brief

Zoho WebNMS Framework, a platform used by telecommunications and network providers to build management systems, contains a critical security flaw in its file upload system. An attacker can exploit this to upload malicious scripts to the server without needing a username or password. If successful, the attacker can take full control of the server, potentially leading to data theft or a complete shutdown of network management operations.

Technical details

A directory traversal vulnerability exists in the FileUploadServlet of Zoho WebNMS Framework 5.2 and 5.2 SP1. The 'fileName' parameter does not properly sanitize input, allowing an unauthenticated remote attacker to use '..' (dot-dot) sequences to save files outside of the intended directory. By specifically targeting the '../jsp/' directory and using filenames such as 'Login.jsp' or 'WebStartXXX.jsp', an attacker can upload and subsequently execute arbitrary JSP payloads. This leads to full remote code execution (RCE) with the privileges of the web server process. At the time of disclosure, the vendor had not provided a patch, and it is recommended to restrict network access to the management interface.

Affected products

  • Zoho WebNMS Framework 5.2, 5.2 SP1

Timeline

  • 2016-04-07: disclosed: Initial discovery and disclosure process started
  • 2016-08-08: advisory: Public advisory released by security researcher
  • 2017-01-23: disclosed: NVD publication date

References