CVE-2021-47667

CVE-2021-47667 is an unauthenticated OS command injection flaw (CWE-78) in lib/NSSDropoff.php of the ZendTo file-transfer web application, affecting releases 5.24-3 through all 6.x versions before 6.10-7. It is triggered when an unauthenticated attacker submits a file dropoff — a POST /dropoff request — with shell metacharacters embedded in the tmp_name parameter, which the application passes to a shell without proper escaping. Successful exploitation lets the attacker execute arbitrary commands on the server running ZendTo, with the CVSS scope-changed, 10.0-critical score reflecting potential impact beyond the vulnerable component. Any internet-reachable ZendTo server in the affected version range is exposed because the attack path requires no authentication and no user interaction. No public proof-of-concept is known and the flaw is not in CISA's KEV catalog, but EPSS assigns a high 35.1% probability of exploitation within 30 days (98th percentile), so defenders should treat active exploitation as likely.

What to do: Upgrade ZendTo to 6.10-7 or later, which closes the injected-command path in the dropoff handling. As an interim mitigation, restrict access to the /dropoff endpoint at the web server or reverse proxy. Review web access logs for POST /dropoff requests containing shell metacharacters (e.g., ; | $ `) in the tmp_name parameter and check the host for unexpected processes, new files, or scheduled tasks as signs of compromise.