This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A Directory Traversal vulnerability in Micro Focus Novell Service Desk.β¦
π‘οΈ **Root Cause**: Improper input validation in the 'import users' function. <br>π **Flaw**: The system fails to sanitize directory traversal characters ('..') in the username field during file uploads.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: Micro Focus Novell Service Desk. <br>π **Versions**: All versions **prior to 7.2**. <br>π’ **Vendor**: Micro Focus (formerly Novell).
Q4What can hackers do? (Privileges/Data)
π΅οΈ **Attacker Action**: Exploits the 'LiveTime.woa' URL via multipart/form-data POST requests. <br>π **Privileges**: Gains the ability to execute arbitrary code (JSP) with the privileges of the application process.
Q5Is exploitation threshold high? (Auth/Config)
β οΈ **Threshold**: **Medium/High**. <br>π **Auth**: Requires authentication (based on 'Authenticated File Upload' in references). <br>π― **Vector**: Specific POST request manipulation.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exp?**: **YES**. <br>π **Sources**: Exploit-DB (39687), Packet Storm, and Rapid7 Metasploit module available. <br>π **Status**: Wild exploitation is possible for those with access.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for Novell Service Desk instances. <br>π§ͺ **Test**: Attempt to upload a file with '..' in the username field via the 'import users' feature.β¦
π§ **No Patch?**: Implement strict input validation on the 'import users' endpoint. <br>π **Block**: Restrict file upload directories. <br>π **WAF**: Configure WAF rules to block '..' sequences in multipart POST requests.
Q10Is it urgent? (Priority Suggestion)
π¨ **Urgency**: **HIGH**. <br>β³ **Priority**: Immediate patching recommended. <br>π‘ **Reason**: RCE vulnerability with public exploits poses a severe risk to server integrity.