CVE-2023-45724
📋 TL;DR
HCL DRYiCE MyXalytics has an unauthenticated file upload vulnerability that allows attackers to upload malicious files without authentication. This affects all users running vulnerable versions of the product, potentially leading to remote code execution or system compromise.
💻 Affected Systems
- HCL DRYiCE MyXalytics
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Malicious file upload leading to web shell deployment, data manipulation, or denial of service.
If Mitigated
Limited impact with proper network segmentation and file upload restrictions in place.
🎯 Exploit Status
Unauthenticated exploitation makes this particularly dangerous; weaponization likely due to CVSS 8.2 score and file upload nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
Restart Required: Yes
Instructions:
1. Review vendor advisory KB0109608 2. Download and apply the latest patch from HCL 3. Restart the MyXalytics service 4. Verify the fix is applied
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to MyXalytics web interface using firewall rules
File Upload Validation
allImplement server-side file type validation and size restrictions
🧯 If You Can't Patch
- Isolate the MyXalytics system from internet and restrict internal network access
- Implement web application firewall (WAF) rules to block file upload attempts
🔍 How to Verify
Check if Vulnerable:
Check if unauthenticated file upload is possible via the web interface; review version against vendor advisoryCheck Version:
Check product version in administration console or configuration filesVerify Fix Applied:
Attempt unauthenticated file upload after patch; should be blocked or require authentication📡 Detection & Monitoring
Log Indicators:
- Unauthenticated file upload attempts
- Unusual file types being uploaded
- Web shell deployment patterns
Network Indicators:
- POST requests to file upload endpoints without authentication headers
- Unusual outbound connections from MyXalytics server
SIEM Query:
source="myxalytics" AND (http_method="POST" AND uri CONTAINS "upload" AND NOT auth_success="true")