ZDI-CAN-22527: ZDI-24-109: Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability
First published: Fri Feb 09 2024(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the uploadSimpleFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Allegro |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-22527?
The severity of ZDI-CAN-22527 is critical due to remote code execution capabilities.
How do I fix ZDI-CAN-22527?
To fix ZDI-CAN-22527, update to the latest patched version of Allegra as specified by the vendor.
What types of attacks can ZDI-CAN-22527 facilitate?
ZDI-CAN-22527 can facilitate remote code execution attacks by allowing attackers to bypass authentication.
What versions of Allegra are affected by ZDI-CAN-22527?
ZDI-CAN-22527 affects specific installations of Allegra that do not have the latest security updates.
Is user authentication a factor in ZDI-CAN-22527?
Yes, although authentication is required, it can be bypassed, making ZDI-CAN-22527 particularly dangerous.
- collector/zdi-published
- source/ZDI
- alias/ZDI-CAN-22527
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/severity
- agent/references
- agent/description
- agent/type
- agent/softwarecombine
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/zdi-advisory
- alias/ZDI-24-109
- alias/CVE-2023-51646
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/allegra
- canonical/allegro