External risk intelligence

FineReport Path Traversal Arbitrary File Write leads to RCE.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2021-48014

FineReport is a business intelligence and reporting software platform. The vulnerability exists within a web-based reporting server component that is designed to be accessed via network requests to save and process report data. Such web-based reporting interfaces are commonly deployed as web applications accessible over the network to facilitate business intelligence operations.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects a web-based reporting system, allowing unauthenticated attackers to write arbitrary files to the server, which could lead to remote code execution. The main concern is confirming relevance and exposure to this type of system.

Unauthenticated users can write files to the server.
This could allow remote control of affected systems.
Understand if this reporting software is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a path traversal vulnerability in the reporting server to write arbitrary files, potentially leading to remote code execution. The attacker initiates this by sending a specially crafted POST request to the `/WebReport/ReportServer` endpoint, leveraging directory traversal sequences within the `filePath` parameter to target specific locations on the server and implant a web shell.

No authentication required.
Triggered by a malicious POST request.
Enables arbitrary file write and RCE.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could write arbitrary files to the server, potentially enabling remote code execution. This occurs through a path traversal vulnerability in the design_save_svg operation.

Arbitrary file writes to server.
Via POST request with directory traversal.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this path traversal vulnerability in FineReport. The first practical step is to locate all instances of the affected reporting software, assess their business criticality and external reachability, and identify the accountable system owner before planning remediation.

Identify affected FineReport deployments.
Confirm external exposure and business impact.
Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FineReport?

FineReport is a business intelligence and data reporting platform. Organizations use it to design, manage, and distribute complex reports and dashboards. It functions as a web-based server application that processes data and generates outputs for business operations, often integrating with various corporate data sources.

What does CVE-2021-48014 mean?

This CVE refers to a Path Traversal weakness (CWE-22) in FineReport 9.0. This flaw allows an attacker to manipulate file paths, enabling them to write files to unintended locations on the server. Because the application processes these files, this capability can be abused to place executable scripts onto the system, resulting in unauthorized remote code execution.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted POST request to the application's report server endpoint. The request uses directory traversal sequences within the 'filePath' parameter to bypass intended file restrictions. Legitimate requests that do not include these specific traversal patterns or unauthorized content payloads do not trigger this vulnerability.

Is my instance of FineReport at risk?

If your instance is reachable over the internet, it is at higher risk, as Halo Surface Signal notes that this reporting component is designed for network interaction. You should determine if your deployment faces the internet or is restricted to internal networks, as external-facing systems are more easily targeted by unauthenticated network-based requests.

How should I respond to this threat?

Begin by auditing your infrastructure to locate all active FineReport 9.0 deployments. Once identified, evaluate the business role of each instance and confirm its network reachability. Coordinate with the application owners to manage the risks associated with these systems while you plan for necessary software updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.