CVE-2022-1752
📋 TL;DR
This vulnerability allows attackers to upload malicious files to the truDesk helpdesk software due to insufficient file type validation. Attackers could upload executable files like PHP scripts, potentially leading to remote code execution. All truDesk instances prior to version 1.2.2 are affected.
💻 Affected Systems
- truDesk
📦 What is this software?
Trudesk by Trudesk Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
File upload leading to web shell deployment, allowing attackers to execute arbitrary commands on the server.
If Mitigated
File upload attempts are blocked or quarantined with no impact on system integrity.
🎯 Exploit Status
Exploitation requires authentication but is straightforward once authenticated. Public proof-of-concept demonstrates file upload bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2
Vendor Advisory: https://github.com/polonel/trudesk/commit/d107f12e71c0fe1e7ac0fdc7463f59c4965a42cd
Restart Required: Yes
Instructions:
1. Backup your truDesk instance and database. 2. Update truDesk to version 1.2.2 or later. 3. Restart the truDesk service. 4. Verify the fix by attempting to upload a malicious file type.
🔧 Temporary Workarounds
Web Server File Type Restriction
allConfigure web server (Apache/Nginx) to block upload of dangerous file types
# Apache: Add to .htaccess
<FilesMatch "\.(php|phtml|php3|php4|php5|phps|pl|py|jsp|asp|sh|cgi)$">
Order Allow,Deny
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~* \.(php|phtml|php3|php4|php5|phps|pl|py|jsp|asp|sh|cgi)$ {
deny all;
}
🧯 If You Can't Patch
- Implement strict file upload validation at the application level, allowing only specific safe file types (e.g., .jpg, .png, .pdf).
- Deploy a Web Application Firewall (WAF) with file upload protection rules to block malicious uploads.
🔍 How to Verify
Check if Vulnerable:
Check truDesk version in admin panel or via package manager. If version is below 1.2.2, the system is vulnerable.Check Version:
Check truDesk admin panel or run: npm list trudesk (if installed via npm)Verify Fix Applied:
After updating to 1.2.2+, attempt to upload a file with dangerous extension (e.g., .php). The upload should be rejected with proper error message.📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts with dangerous extensions
- Successful upload of files with .php, .jsp, .asp extensions
- Unusual file upload activity from single user
Network Indicators:
- POST requests to upload endpoints with dangerous file types
- Unusual outbound connections from truDesk server after file upload
SIEM Query:
source="truDesk" AND (event="file_upload" AND file_extension IN ("php", "jsp", "asp", "pl", "py"))