Full Report
Huntress has analyzed the emerging SysAid CVE-2023-47246 vulnerability and recreated the attack chain with a proof-of-concept exploit.
Analysis Summary
# Vulnerability: Path Traversal and RCE in SysAid On-Premise Software
## CVE Details
- **CVE ID:** CVE-2023-47246
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
## Affected Systems
- **Products:** SysAid On-Premise Server software.
- **Versions:** All versions prior to 23.3.36 (specifically noted across a wide range including 7.x, 16.x, 17.x, and 23.x).
- **Configurations:** Systems where the SysAid Apache Tomcat web server is accessible, particularly those with internet-facing management consoles.
## Vulnerability Description
CVE-2023-47246 is a path traversal vulnerability that allows an unauthenticated attacker to write arbitrary files to the underlying server. By exploiting this flaw, attackers can upload a malicious Web Application Resource (WAR) file containing a webshell into the webroot of the SysAid Apache Tomcat server. This results in unauthorized remote code execution (RCE) within the context of the SysAid service (typically running as `java.exe`).
## Exploitation
- **Status:** **Exploited in the wild.** Attributed to threat actor TA505 (also known as Lace Tempest or the cl0p ransomware gang).
- **Complexity:** Low.
- **Attack Vector:** Network (Remote).
- **PoC Availability:** Huntress has successfully recreated a fully weaponized proof-of-concept (PoC).
## Impact
- **Confidentiality:** Critical (Total access to system data).
- **Integrity:** Critical (Ability to modify system files and configurations).
- **Availability:** Critical (Potential for ransomware deployment or system shutdown).
## Remediation
### Patches
- **Recommended Version:** Upgrade to **SysAid Server 23.3.36** or later immediately.
- [Vendor Patch Link](https://documentation.sysaid.com/docs/23336)
### Workarounds
- **Network Segmentation:** Restrict access to the SysAid server to internal IP addresses or via VPN only.
- **Restricted Permissions:** Ensure the service account running SysAid has the least privilege necessary.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of unusual WAR files or webshells in: `C:\Program Files\SysAidServer\tomcat\webapps\usersfiles\`
- Suspicious child processes spawned by `java.exe` (specifically `powershell.exe` executing Base64 encoded commands).
- **Detection Methods:**
- Monitor for unexpected file creation in the Tomcat `webapps` directory.
- Audit PowerShell logs for deobfuscated scripts originating from the SysAid application path.
## References
- **SysAid Advisory:** [https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification](https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification)
- **Huntress Analysis:** [https://www.huntress.com/blog/critical-vulnerability-sysaid-cve-2023-47246](https://www.huntress.com/blog/critical-vulnerability-sysaid-cve-2023-47246)
- **MITRE CVE:** [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47246)