[FD] Security advisory: Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) in Output Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology))

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Output 
Messenger Server 2.0.x (>= 2.0.63) (Srimax Software (Output Technology)). The 
research is published and a proof-of-concept is available.

Pre-authentication SYSTEM RCE (Zip-Slip plugin planting) (CVSS 9.8, 
pre-authentication)

Output Messenger Server 2.0.x accepts XMPP connections on TCP 14121 with no 
SASL and no credentials; every connection is treated as authenticated. Through 
linkserver registration and the file-transfer listener, an unauthenticated 
attacker uploads a crafted ZIP whose entries escape the plugin directory 
(Zip-Slip in SharpZipLib 0.85.4). On service restart, the planted plugin 
constructor executes as LocalSystem. Dynamically verified.

Impact: Full compromise of the on-premise enterprise instant-messaging server 
as LocalSystem. The attacker can read corporate communications, execute 
arbitrary commands, and move laterally inside the office network.

Advisory: 
https://0day-rubbish.com/blog/output-messenger-unauth-zipslip-plugin-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/