CVE-2016-5050
📋 TL;DR
CVE-2016-5050 is an unrestricted file upload vulnerability in ReadyDesk's chat/sendfile.aspx component that allows remote attackers to upload and execute arbitrary .aspx files, leading to remote code execution. This affects ReadyDesk 9.1 installations, potentially compromising the entire server.
💻 Affected Systems
- ReadyDesk
📦 What is this software?
Readydesk by Readydesk
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full administrative control, data exfiltration, and lateral movement to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a pivot point for further attacks.
If Mitigated
Attack blocked at web application firewall level with no file execution possible.
🎯 Exploit Status
Simple HTTP POST request with malicious .aspx file. Multiple public exploit scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2 or later
Vendor Advisory: http://www.kb.cert.org/vuls/id/294272
Restart Required: No
Instructions:
1. Upgrade ReadyDesk to version 9.2 or later. 2. Apply vendor-provided patch if available. 3. Restart IIS application pool.
🔧 Temporary Workarounds
File Extension Restriction
windowsBlock .aspx file uploads via web server configuration
IIS: Add request filtering rule to deny .aspx extensions
Path Restriction
windowsRemove or restrict access to chat/sendfile.aspx
Remove chat/sendfile.aspx file or configure IIS to deny access to this path
🧯 If You Can't Patch
- Implement strict file upload validation allowing only specific safe extensions
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test .aspx file to /chat/sendfile.aspx and verify if it executesCheck Version:
Check ReadyDesk admin panel or web.config for version informationVerify Fix Applied:
Verify ReadyDesk version is 9.2+ and test file upload with .aspx extension is rejected📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /chat/sendfile.aspx with .aspx files
- IIS logs showing .aspx file execution from upload directory
Network Indicators:
- Unusual outbound connections from web server
- POST requests with file uploads to vulnerable endpoint
SIEM Query:
source="IIS" AND (url="/chat/sendfile.aspx" OR file_extension=".aspx")