Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in SysAid On-Premise allows attackers to execute code. This occurs when an attacker writes a file to the Tomcat webroot. The core issue involves a path traversal flaw.
- Vulnerable SysAid On-Premise
- Path traversal leads to code execution
- Potential for unauthorized system access
Attack Path
How an attacker could exploit the issue
The vulnerability allows an attacker to write a file to the Tomcat webroot. This can lead to code execution on the affected system. This exploit was observed in the wild in November 2023.
- Unauthenticated network exposure
- Attacker writes a malicious file
- Code execution on the server
Live Threat
Current exploitation, exposure, and threat context
A critical vulnerability has been identified that could allow attackers to execute code on affected systems. This issue arises from a path traversal flaw, enabling an attacker to write a file to a sensitive web server directory. The exploitation of this vulnerability has been observed in real-world attacks.
- Likely attacker skill level: Low.
- Required access or conditions: None.
- Business risk or urgency: High.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability allows an attacker to execute code by writing a file to the web server's root directory. Organizations using the affected SysAid software on-premises may face risks to their systems and data if this vulnerability is exploited. The immediate focus should be on identifying and mitigating the exposure of this software.
- Find affected SysAid assets.
- Reduce exposure or isolate risk.
- Fix, verify, and monitor.
