CVE-2020-25247
📋 TL;DR
This CVE describes a directory traversal vulnerability in Hyland OnBase that allows attackers to write files to arbitrary locations on the server. Attackers can exploit this by manipulating the FileName parameter to traverse directories and write malicious files. This affects OnBase versions through 18.0.0.32 and 19.x through 19.8.9.1000.
💻 Affected Systems
- Hyland OnBase
📦 What is this software?
Onbase by Hyland
Onbase by Hyland
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data exfiltration, or system destruction.
Likely Case
Unauthorized file creation/modification leading to data corruption, privilege escalation, or persistence mechanisms.
If Mitigated
Limited impact with proper file system permissions, input validation, and network segmentation in place.
🎯 Exploit Status
Directory traversal vulnerabilities are typically easy to exploit with basic HTTP parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 18.0.0.32 and 19.8.9.1000
Vendor Advisory: https://www.hyland.com/en/security-advisories
Restart Required: Yes
Instructions:
1. Contact Hyland support for appropriate patches. 2. Apply patches to all affected OnBase servers. 3. Restart OnBase services. 4. Test functionality after patching.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to block directory traversal patterns
WAF rule: block requests containing '../' or '..\' in FileName parameter
File System Permissions
windowsRestrict write permissions to OnBase application directories only
Windows: icacls "C:\Program Files\OnBase" /deny "Everyone":(OI)(CI)W
🧯 If You Can't Patch
- Network segmentation: Isolate OnBase servers from internet and restrict internal access
- Implement strict file system permissions and monitor for unauthorized file writes
🔍 How to Verify
Check if Vulnerable:
Check OnBase version via administration console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\OnBase\VersionCheck Version:
reg query "HKLM\SOFTWARE\OnBase" /v VersionVerify Fix Applied:
Verify version is above vulnerable ranges and test FileName parameter with traversal attempts returns error📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' or '..\' in FileName parameter
- Unexpected file creation in system directories
Network Indicators:
- HTTP POST/PUT requests to OnBase endpoints with path traversal patterns
SIEM Query:
source="onbase.log" AND (FileName="*../*" OR FileName="*..\\*")