SysAid Patches CVE-2023-47246 Path-Traversal Flaw Exploited in the Wild
Summary
Huntress describes in-the-wild exploitation of a path-traversal flaw in SysAid Server, attributed by Microsoft to TA505/Lace Tempest, and urges users to update to version 23.3.36.
Key points
- SysAid disclosed CVE-2023-47246 on November 8, 2023, describing a path-traversal vulnerability that can lead to code execution in on-premises servers.
- Microsoft attributed the compromises to TA505, also known as Lace Tempest; Huntress reported observing one compromised server among 14 SysAid instances in its partner environments.
- Huntress observed PowerShell activity that checked for Sophos processes, ran an attacker-placed executable, and attempted to remove exploitation artifacts and log entries.
- The researchers demonstrated that a crafted accountID parameter in a POST request could direct a compressed WAR webshell to a chosen server location, enabling access through the webshell.
- Huntress said it had developed a weaponized proof of concept but was not releasing it publicly, and added detections for the reported activity.
- SysAid Server version 23.3.36 is the recommended update. Huntress also advised organizations to check whether their servers are publicly accessible.
Article Details
- Vulnerability Types
- Path traversal
- Arbitrary file write leading to code execution
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- claimed_or_private
- Patch Status
- available
MITRE ATT&CK
T1059.001 · PowerShellThe post-exploitation activity used PowerShell to run commands, including an Invoke-Expression invocation.T1070.004 · File DeletionPowerShell code removed the userfiles.war stager and user.exe artifacts after execution.T1105 · Ingress Tool TransferA user.exe payload was placed in the userfiles staging directory and invoked by the post-exploitation PowerShell code.T1505.003 · Web ShellThe attackers uploaded a WAR webshell into the SysAid Apache Tomcat webroot and requested it to gain server access.
CVE
People
Caleb StewartNamed contributor to the Huntress writeup.Dave KleinatlandNamed contributor to the Huntress writeup.Harlan CarveyNamed contributor to the Huntress writeup.Jamie LevyNamed contributor to the Huntress writeup.Joe SlowikNamed contributor to the Huntress writeup.John HammondNamed contributor to the Huntress writeup.Matt AndersonNamed contributor to the Huntress writeup.Matt KielyNamed contributor to the Huntress writeup.
Threat Actors
Malware
Vendors
Products
Apache Tomcatfor attackers to upload and access WAR file webshells and other payloads in the webroot of the SysAid Apache Tomcat web server. It also references the full path of a webshell that was located atC:\ProgramSysAid ServerCurrently, the latest version of SysAid Server 23.3.36 is the recommended patch and update that we strongly urge you to install as soon as possible.