Horizon Alert
Summary of the vulnerability and why it matters
Trimble Cityworks software contains a deserialization vulnerability that could permit an authenticated user to execute code remotely on a customer's Microsoft Internet Information Services (IIS) web server. This flaw is present in versions prior to 15.8.9, and in Cityworks with office companion versions prior to 23.10. The successful exploitation of this vulnerability could lead to a compromise of the affected web server.
- Vulnerable: Trimble Cityworks
- Flaw: Deserialization vulnerability
- Impact: Remote code execution
Attack Path
How an attacker could exploit the issue
A deserialization vulnerability in Trimble Cityworks allows an authenticated user to execute arbitrary code on the underlying web server. This occurs when the affected software processes specifically crafted serialized data. Successful exploitation enables an attacker to gain control of the web server, potentially impacting data integrity and availability.
- Exposure condition: Internet-facing web server.
- Attacker starting point: Authenticated user.
- Trigger and result: Trigger deserialization; gain remote control.
Live Threat
Current exploitation, exposure, and threat context
Trimble Cityworks is vulnerable to a deserialization flaw that enables authenticated users to execute remote code on an organization's web server. This vulnerability has been actively exploited in the wild, posing a significant risk to organizations that use this software, particularly those in critical infrastructure sectors. The exploitation could lead to unauthorized access to sensitive data, service disruptions, or a complete compromise of the affected web server.
- Attackers with authenticated access.
- Remotely, with low difficulty.
- High business risk and urgency.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An organization utilizing Trimble Cityworks should address a deserialization vulnerability that could enable authenticated users to execute remote code on a Microsoft Internet Information Services (IIS) web server. This vulnerability poses a significant risk to affected systems and the data they manage. Organizations should prioritize immediate action to identify and mitigate this exposure.
- Identify all instances of affected Trimble Cityworks.
- Restrict access to or isolate exposed systems.
- Apply vendor updates, verify remediation, and monitor systems.
