CVE-2022-24251
📋 TL;DR
Extensis Portfolio v4.0 contains an authenticated unrestricted file upload vulnerability in the Catalog Asset Upload function. This allows authenticated attackers to upload malicious files to the server, potentially leading to remote code execution. Organizations using Extensis Portfolio v4.0 are affected.
💻 Affected Systems
- Extensis Portfolio
📦 What is this software?
Portfolio by Extensis
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker uploads webshell or malicious executable, gains remote code execution with server privileges, and compromises the entire system.
Likely Case
Authenticated user or compromised account uploads malicious file leading to server compromise, data theft, or lateral movement.
If Mitigated
With proper file type validation and authentication controls, impact limited to unauthorized file storage without execution.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.1 or later
Vendor Advisory: http://extensis.com
Restart Required: Yes
Instructions:
1. Download latest version from Extensis website. 2. Backup current installation. 3. Install update following vendor instructions. 4. Restart Portfolio services.
🔧 Temporary Workarounds
Restrict file upload types
allConfigure Portfolio to only accept specific safe file extensions for uploads.
Implement web application firewall rules
allBlock uploads of executable files and scripts via WAF.
🧯 If You Can't Patch
- Disable Catalog Asset Upload functionality entirely
- Implement strict network segmentation and limit access to Portfolio servers
🔍 How to Verify
Check if Vulnerable:
Check Portfolio version in admin interface or about dialog. If version is exactly 4.0, system is vulnerable.Check Version:
Check Portfolio admin dashboard or about dialog for version information.Verify Fix Applied:
Verify version is 4.0.1 or higher and test file upload with restricted file types.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Catalog Asset Upload endpoint
- Uploads of executable files (.exe, .php, .jsp, etc.)
Network Indicators:
- POST requests to upload endpoints with unusual file types
- Large file uploads to Portfolio servers
SIEM Query:
source="portfolio.log" AND (event="file_upload" AND file_extension IN ("exe", "php", "jsp", "asp", "aspx"))