External risk intelligence

SmartBI Unrestricted File Upload Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2023-7305

SmartBI is a business intelligence application typically deployed as a web-based service for enterprise reporting and data visualization. Such platforms are commonly exposed to the internet or wide internal networks to allow access for multiple users and external stakeholders, making the web-based servlet endpoint a likely candidate for public-facing exposure.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects SmartBI business intelligence software, allowing unauthorized users to upload files that could lead to code execution on the host system. The vendor has provided a fix, and this issue has been observed being exploited in the wild.

File upload flaw enables unauthorized code execution.
Critical vulnerability, actively exploited in the wild.
Confirm relevance and potential exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can reach the SmartBI application over the network and send a specially crafted request to the RMIServlet. This request bypasses security checks, allowing the attacker to upload a malicious file. If the application is configured in a certain way, this uploaded file can then be executed, potentially leading to sensitive operations or arbitrary code execution on the host system.

Network access to the application.
Sending a crafted file upload request.
Sensitive operations or code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's configuration, this vulnerability could allow an attacker to upload arbitrary files, potentially leading to the execution of malicious code on the host system.

System data could be compromised.
Sensitive operations may occur.
Code execution on the host.

Operational Fix

Recommended remediation, mitigation, and detection steps

SmartBI RMI Servlet vulnerability exploitation requires identifying where this business intelligence platform is deployed and its accessibility. Application owners, in conjunction with infrastructure and security teams, should prioritize locating all instances, assessing their reachability and criticality, and confirming ownership before planning remediation.

Application owners should own the issue.
Verify instance reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SmartBI?

SmartBI is an enterprise business intelligence platform designed for reporting, data visualization, and organizational analytics. It functions as a web-based service, typically deployed within corporate environments to aggregate data for various stakeholders. Because it handles significant business data and requires broad user access, it is often configured as a centralized hub accessible over internal networks or the internet.

How does CVE-2023-7305 work?

This vulnerability is classified as an Unrestricted File Upload (CWE-434). It stems from flaws in the RMIServlet request handling logic, which fails to properly validate incoming data. By sending a specially crafted request, an attacker can bypass security restrictions to place arbitrary files on the host system. Depending on the server configuration, these files can be executed, granting the attacker the ability to run code or perform sensitive operations directly on the server.

What triggers this file upload vulnerability?

An attacker triggers this bug by sending a maliciously crafted network request directly to the application's RMIServlet endpoint. The flaw is not triggered by standard, authorized data reporting or regular user interaction with the dashboard. It specifically requires interaction with the servlet's handling logic to bypass security checks and initiate the unauthorized upload process.

Why is this CVE relevant to my network?

According to Halo Surface Signal, this vulnerability is highly relevant because SmartBI is frequently deployed as a web-facing service. If your instance is accessible via the internet or wide internal networks, it creates a potential entry point for remote attackers. Even internal-only deployments are risky if they reside on segments reachable by unauthorized users who can route traffic to the affected RMIServlet endpoint.

How do I respond to this SmartBI advisory?

Start by identifying all deployed SmartBI instances within your organization and confirming their network reachability. Once you have an inventory, coordinate with your infrastructure team to verify if the version in use is affected. Prioritize remediation by applying the vendor-supplied patch released in July 2023, which resolves the underlying servlet handling flaw. Ensure this is managed through your standard software update lifecycle to maintain operational stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.