Executive brief
Wertheim SafeController, a software suite used by banks to manage safe deposit boxes and vault access, contains a security flaw in its document upload system. An authorized user, regardless of their permission level, can bypass security checks to upload any file type to the server by spoofing the file's metadata. This could allow an attacker to place malicious files on the system, potentially leading to a full server takeover when combined with other known vulnerabilities in the product.
Technical details
The vulnerability exists in the '/safe/contract/uploadcustomdocuments' endpoint of the Wertheim SafeController Software (AssemblyVersion 6.15.8328.28014). The application performs file type validation by checking the user-controlled HTTP Content-Type header for allowed strings (e.g., pdf, jpeg, tiff, png) rather than validating the actual file content or extension. An authenticated attacker with low-level privileges can spoof this header to upload arbitrary files. When chained with other vulnerabilities identified in the same advisory (such as path traversal or unauthenticated access to web data), this can lead to Remote Code Execution (RCE) and full system compromise, especially as the service is known to run with NT AUTHORITY/SYSTEM privileges.
Affected products
- Wertheim SafeController Software for VAULT ROOMS (Safe Service 6.0) AssemblyVersion 6.15.8328.28014
Timeline
- 2023-04-03: other: Vulnerability discovered by SEC Consult
- 2026-06-15: disclosed: Public disclosure of CVE-2026-34027