CVE-2023-4760
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Windows systems running vulnerable Eclipse RAP versions. Attackers can exploit insecure filename handling in the FileUpload component to write malicious files to sensitive directories like Tomcat's webapps folder. Only Eclipse RAP applications using the FileUpload component on Windows are affected.
💻 Affected Systems
- Eclipse RAP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution, allowing attackers to deploy web shells, steal data, or pivot to other systems.
Likely Case
Web shell deployment leading to data exfiltration, credential theft, or lateral movement within the network.
If Mitigated
File upload attempts are blocked or sanitized, preventing malicious file placement.
🎯 Exploit Status
Exploitation requires file upload functionality but no authentication; path traversal via backslashes enables arbitrary file write.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.26.0
Vendor Advisory: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/160
Restart Required: Yes
Instructions:
1. Upgrade Eclipse RAP to version 3.26.0 or later. 2. Replace the FileUpload component with the patched version. 3. Restart the application server.
🔧 Temporary Workarounds
Disable FileUpload Component
allTemporarily disable or remove the FileUpload component from the application.
Modify application configuration to disable file upload functionality
Implement Input Validation
windowsAdd server-side validation to reject filenames containing path traversal sequences.
Implement filename sanitization: reject any filename containing '..\' or similar patterns
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) with rules to block path traversal attempts in file uploads.
- Restrict file upload permissions to non-executable directories and implement strict file type validation.
🔍 How to Verify
Check if Vulnerable:
Check if Eclipse RAP version is between 3.0.0 and 3.25.0 and FileUpload component is used on Windows.Check Version:
Check application dependencies or build configuration for org.eclipse.rap version.Verify Fix Applied:
Verify Eclipse RAP version is 3.26.0 or later and test file upload with malicious filenames to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- File upload requests with filenames containing '..\' patterns
- Unexpected file writes to webapps or other sensitive directories
Network Indicators:
- HTTP POST requests to file upload endpoints with suspicious filenames
SIEM Query:
source="web_logs" AND (filename="*..\\*" OR path="*..\\*")