Vulnerability in FanRuan FineReport

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.8

[ Description ]Official description

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/NHPT/WebReportV9Exp/blob/main/WebReport_Exp.py
• github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%B8%86%E8%BD%AFOA/%E5%B8%86…
• github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/finereport/…
• www.fanruan.com/en/finereport
• www.vulncheck.com/advisories/finereport-9.0-unauthenticated-path-traversal-file-write-v…