CVE-2020-29441
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files to OutSystems Platform 10 instances. It affects organizations using OutSystems Platform 10 versions before 10.0.1019.0, potentially leading to denial of service, data corruption, or unauthorized access to uploaded files.
💻 Affected Systems
- OutSystems Platform
📦 What is this software?
Outsystems by Outsystems
⚠️ Risk & Real-World Impact
Worst Case
Complete database space exhaustion causing system-wide denial of service, corruption of legitimate business data, and unauthorized access to sensitive uploaded files.
Likely Case
Database space consumption leading to service degradation or temporary unavailability, with potential for file system pollution.
If Mitigated
Minimal impact with proper file upload validation, authentication requirements, and monitoring in place.
🎯 Exploit Status
The vulnerability is straightforward to exploit as it requires no authentication and involves simple file upload operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.1019.0
Vendor Advisory: https://success.outsystems.com/Support/Security/Vulnerabilities/Vulnerability_RPD-4310
Restart Required: Yes
Instructions:
1. Download OutSystems Platform 10.0.1019.0 or later from official sources. 2. Backup your current installation and database. 3. Apply the update following OutSystems upgrade procedures. 4. Restart the platform services.
🔧 Temporary Workarounds
Disable Upload Widget
allTemporarily disable or remove the vulnerable Upload Widget component from applications.
Implement WAF Rules
allConfigure web application firewall rules to block suspicious file upload patterns.
🧯 If You Can't Patch
- Implement strict file type validation and size limits on all upload endpoints
- Require authentication for all file upload operations and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check OutSystems Platform version in Service Center or compare against installed version number.Check Version:
Check Service Center dashboard or review installation logs for version information.Verify Fix Applied:
Verify version is 10.0.1019.0 or later and test file upload functionality with malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of file upload requests
- Uploads of unexpected file types or sizes
- Failed authentication attempts on upload endpoints
Network Indicators:
- High volume of POST requests to upload endpoints
- Large file uploads from unauthenticated sources
SIEM Query:
source="outsystems" AND (event="file_upload" OR url_path="*upload*") AND user="anonymous" AND file_size>1000000