Incorrect Access Control in Reportico Web Leads to RCE

Executive Summary

This is an incorrect access control vulnerability in reportico-web versions 8.1.0 and earlier. It allows unauthenticated attackers to inject arbitrary PHP code into the PreExecuteCode attribute of any report, bypassing safe_mode settings. This leads to remote code execution on the affected system.

Useful 0 Not Useful 0

Detection Guidance

Check if reportico-web versions 8.1.0 or earlier are installed on your system. Look for unusual PHP code execution patterns or unauthorized report modifications. Use network monitoring tools to detect suspicious outbound connections from the application server.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code on your server, potentially taking full control of the system. This could lead to data theft, system compromise, or further network infiltration. Unauthenticated access means any external user can attempt exploitation without credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security controls. GDPR requires adequate technical measures to prevent unauthorized access. HIPAA mandates strict access controls for protected health information. Exploitation could result in data breaches, leading to regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade reportico-web to a version beyond 8.1.0 immediately. Disable or restrict access to report creation/modification features for unauthorized users. Review and remove any suspicious reports containing PHP code in the PreExecuteCode attribute.

Useful 0 Not Useful 0