[FD] Security advisory: Pre-authentication RCE (arbitrary file write) in RapidDeploy 5.2.2 (MidVision)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in 
RapidDeploy 5.2.2 (MidVision). The research is published and a proof-of-concept 
is available.

Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication)

MidVision RapidDeploy 5.2.2 ships a remote-agent template 
(midvision-remoting-server.xml) with host=0.0.0.0 and auth.servers commented 
out, making the JBoss Remoting layer network-reachable with no authentication. 
The invocation handler accepts any connection and performs arbitrary-path file 
writes on the target host; writing a cron entry yields root command execution. 
This is a shipped default-deployment template vulnerability. Dynamically 
verified.

Impact: Full compromise of CI/CD target hosts as root. The attacker can 
overwrite deployed artifacts, inject trojans into build and deploy pipelines, 
and take control of every managed server.

Advisory: 
https://0day-rubbish.com/blog/midvision-rapiddeploy-unauth-file-write-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/