Unauthenticated File Upload in ERP System

Executive Summary

This vulnerability is in an ERP system due to weak authentication and insufficient file type checks at an API endpoint. An attacker can upload malicious files to a web-accessible directory without authentication.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file uploads in web-accessible directories. Inspect server logs for unusual POST requests to API endpoints, particularly those handling file uploads. Look for files with unexpected extensions or content in directories like /uploads, /temp, or /files. Use commands like 'find /var/www -type f -mtime -1' to find recently modified files or 'grep -r 'POST /api/upload' /var/log/nginx/' to check for suspicious API calls.

Useful 0 Not Useful 0

Impact Analysis

Exploitation could let attackers run arbitrary code and fully compromise the affected system, leading to data theft, system damage, or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict write permissions to web-accessible directories. Disable unauthenticated file upload endpoints if possible. Implement strict file type validation, allowing only specific safe extensions. Update authentication controls to require valid sessions for all API endpoints. Monitor network traffic for signs of exploitation attempts.

Useful 0 Not Useful 0