CVE-2021-48014: FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer designsavesvg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can exploit the exposed ReportServer endpoint remotely by sending a POST request to the design_save_svg operation.
What is the practical impact of successful exploitation?
An attacker can use directory traversal in the filePath parameter to write arbitrary files. Writing a JSP webshell through the __CONTENT__ payload can result in remote code execution with the permissions of the affected FineReport service.
How can defenders identify potential exploitation?
Review requests to /WebReport/ReportServer that invoke design_save_svg, especially POST requests whose filePath values contain directory-traversal sequences or whose payloads include __CONTENT__. Investigate unexpected JSP files or other newly written files in locations accessible to the FineReport deployment.
Is there evidence that this vulnerability has been exploited?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.