Executive Summary

The vulnerability in Sparx Pro Cloud Server is a race condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads an object based on a guid parameter and saves its content as a file in the current directory. An attacker with repository access can control both the filename and the file contents, allowing them to create a malicious PHP file in that directory.

Although the malicious file is deleted after processing, if the response transmission is delayed (for example, due to a large file or slow client connection), the file remains accessible temporarily. During this window, the attacker can send a second request to execute the malicious PHP file, leading to remote code execution on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with repository access to execute arbitrary code remotely on the affected server. This means the attacker could potentially take control of the server, access sensitive data, modify or delete files, disrupt services, or use the server as a foothold to attack other systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects Sparx Pro Cloud Server version 6.1 (build 167) and below. Immediate mitigation steps include restricting repository access to trusted users only, as an attacker needs repository access to exploit the vulnerability.

Additionally, monitoring and limiting slow client connections or large file downloads to reduce the window of the race condition may help mitigate exploitation.

Since the vendor has not provided patches or detailed version information, consider upgrading to a version above 6.1 if available and confirmed safe, or applying network-level protections to limit access to the vulnerable endpoint.

Useful 0 Not Useful 0