Vulnerability Description
An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-encode-path HTTP header, and the content in the HTTP request body. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full system access as the configured user (e.g., Administrator) when starting from any authenticated session (e.g., a trial account). This is fixed in the 83/830122/cbs-*-hotfix-task26000 builds.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ahsay | Cloud Backup Suite | 8.3.0.30 |
Related Weaknesses (CWE)
References
- https://www.wbsec.nl/ahsay-2/ExploitThird Party Advisory
- https://www.wbsec.nl/ahsay-2/ExploitThird Party Advisory
FAQ
What is CVE-2020-5846?
CVE-2020-5846 is a vulnerability with a CVSS score of 8.8 (HIGH). An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" request with the base64-encoded pathname in the X-RSW-custom-enco...
How severe is CVE-2020-5846?
CVE-2020-5846 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5846?
Check the references section above for vendor advisories and patch information. Affected products include: Ahsay Cloud Backup Suite.