[0day-rubbish] SmartBear Collaborator Server 15.1.15101 authenticated DOORS/Simulink review-file upload zip-slip to anonymous webroot Groovy Server Page execution as uid 1001 (7.5)
SmartBear Collaborator 15.1 zip-slip lets a low-privilege user enable anonymous code execution.
The 0day Rubbish Research Team disclosed a flaw in SmartBear Collaborator Server 15.1.15101, a Java code-review application on Apache Tomcat. A low-privilege authenticated user can place a Groovy Server Page in the Tomcat webroot through archive-extraction path traversal during DOORS or Simulink review-file upload. Any anonymous client can then request that page, which executes as uid 1001. The claimed score is 7.5, and no CVE or in-the-wild exploitation is stated.
- Affects SmartBear Collaborator Server 15.1.15101 on Tomcat.
- Low-privilege user plants a Groovy Server Page via zip-slip.
- Anonymous clients can then execute the planted page.
- Execution is as uid 1001; claimed score 7.5.
- Vendors
- SmartBear
- Products
- Collaborator Server
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear Collaborator Server 15. 1. 15101, the closed-source peer and technical code-review platform from SmartBear that runs as a Java web application on Apache Tomcat.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.