CVE-2021-45887
📋 TL;DR
This vulnerability allows authenticated administrators of PONTON X/P Messenger to upload ZIP files containing executable scripts via a path traversal flaw. Attackers can achieve remote code execution on the underlying server by accessing uploaded scripts through imgs/*.jsp URIs. Only administrators with upload privileges are directly affected, but successful exploitation compromises the entire server.
💻 Affected Systems
- PONTON X/P Messenger
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary code, access sensitive data, pivot to other systems, and maintain persistent access.
Likely Case
Attackers gain remote code execution on the web server, potentially accessing application data, user information, and using the server as a foothold for further attacks.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained, limiting impact to the web application layer.
🎯 Exploit Status
Exploitation requires administrator credentials but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.2
Vendor Advisory: https://www.ponton.de/products/xpmessenger/
Restart Required: Yes
Instructions:
1. Download version 3.11.2 or later from vendor. 2. Backup current installation and data. 3. Stop the X/P Messenger service. 4. Install the updated version. 5. Restart the service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict ZIP uploads
allDisable or restrict ZIP file uploads through the SchemaSetUpload.do endpoint
Modify application configuration to reject ZIP files at private/SchemaSetUpload.do
Access control hardening
allImplement strict access controls and monitoring for administrator accounts
Enable multi-factor authentication for admin accounts
Implement session timeout policies
Monitor admin login and file upload activities
🧯 If You Can't Patch
- Implement web application firewall rules to block requests to private/SchemaSetUpload.do containing ZIP files
- Restrict network access to the administration interface to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check application version in admin interface or configuration files. If version is below 3.11.2, system is vulnerable.Check Version:
Check application web interface or configuration files for version informationVerify Fix Applied:
Verify version is 3.11.2 or higher and test that ZIP file uploads through private/SchemaSetUpload.do are properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual ZIP file uploads to private/SchemaSetUpload.do
- Access to imgs/*.jsp files that don't match normal patterns
- Administrator account login from unusual locations
Network Indicators:
- HTTP POST requests to private/SchemaSetUpload.do with ZIP content
- HTTP GET requests to imgs/*.jsp with unusual parameters
SIEM Query:
source="web_server" AND (uri="/private/SchemaSetUpload.do" OR uri LIKE "/imgs/%.jsp")