Sign In
Advisories

DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE

Go Back
severity
critical
date
Affecting

  • Altec DocLink <= 4.0.336.0

  • An affected version range remains undefined

CWE
  • CWE-502 Deserialization of Untrusted Data
  • CWE-918 Server-Side Request Forgery (SSRF)
CVSS
10
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Credit
Victor A. Morales, Senior Pentester Team Leader, GM Sectec, Corp, Omar Crespo, Pentester, GM Sectec, Corp
Description
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling, allowing remote attackers to read arbitrary files from the underlying system by specifying local file paths. Additionally, attackers can coerce SMB authentication via UNC paths and write arbitrary files to server locations. Because writable paths may be web-accessible under IIS, this can result in unauthenticated remote code execution or denial of service through file overwrite.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo