Royal Render 9.1.26b job port runs shells on workers
Original title: [0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High)
Default-unauthenticated submissions on rrServer TCP 7773 execute as the worker identity, measured as root.
0day Rubbish Research Team publicly disclosed a flaw in Royal Render 9.1.26b, Binary Alchemy's closed-source render-farm job manager for VFX and animation studios in Ludwigsburg, Germany. Job submission on rrServer TCP 7773 is unauthenticated by default and reaches worker-side shell execution as the worker identity, measured as root. The post says this is unrelated to Royal Apps GmbH's Royal Server. No CVE, patch, or confirmed exploitation is in the snippet.
Unconfirmed: The snippet does not state a CVE, a fix, or confirmed in-the-wild exploitation.
- The stated score is 8.1 High.
- The vendor is Binary Alchemy, proprietor Holger Schoenberger.
- Royal Render is not the Royal Server product from Royal Apps GmbH.
- The post went to Full Disclosure on October 20.
Impact: Unauthenticated jobs run shells as the worker, measured root
| Product | Affected |
|---|---|
| Binary Alchemy Royal Render | 9.1.26b |
- Vendors
- Binary Alchemy
- Products
- Royal Render
- Organizations
- 0day Rubbish Research Team
- Countries
- Germany
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in Royal Render 9. 1. 26b, the closed-source render-farm job manager for VFX and animation studios from Binary Alchemy (proprietor Holger Schoenberger) of Ludwigsburg, Germany.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.