CVE-2019-19988
📋 TL;DR
This vulnerability allows authenticated users to create arbitrary files with any content anywhere on the filesystem via a web interface component. It affects Selesta Visual Access Manager (VAM) installations where users have valid credentials. Attackers can write malicious files to execute code or compromise the system.
💻 Affected Systems
- Selesta Visual Access Manager (VAM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, data exfiltration, or complete system takeover by writing web shells or malicious executables.
Likely Case
Web shell deployment leading to persistent access, privilege escalation, and lateral movement within the network.
If Mitigated
Limited impact if file permissions restrict write access to non-critical directories and web server runs with minimal privileges.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward via HTTP POST requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.30 or later
Vendor Advisory: https://www.seling.it/
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Download VAM version 4.30+ from vendor. 3. Install update following vendor documentation. 4. Restart VAM services. 5. Verify functionality.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to /common/vam_editXml.php via web server configuration or firewall.
# Apache: <Location "/common/vam_editXml.php"> Require all denied </Location>
# Nginx: location /common/vam_editXml.php { deny all; }
File system permissions
linuxRestrict write permissions on web directory to prevent file creation.
chmod -R 755 /var/www/vam/
chown -R root:www-data /var/www/vam/
🧯 If You Can't Patch
- Implement strict network segmentation to isolate VAM from critical systems.
- Enforce least privilege access controls and monitor for suspicious file creation activities.
🔍 How to Verify
Check if Vulnerable:
Check if /common/vam_editXml.php exists and accepts POST requests with file creation parameters.Check Version:
Check VAM web interface admin panel or configuration files for version number.Verify Fix Applied:
Confirm VAM version is 4.30+ and test that /common/vam_editXml.php no longer allows arbitrary file creation.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /common/vam_editXml.php with unusual file parameters
- Unexpected file creation in web directories
Network Indicators:
- POST requests to vulnerable endpoint with XML or file content
SIEM Query:
source="web_logs" AND uri="/common/vam_editXml.php" AND method="POST"