CVE-2018-1552

Vulnerability

IBM Robotic Process Automation with Automation Anywhere versions 10.0 and 11.0 contain a missing restriction on the types of files that can be uploaded to the control room. This allows a remote attacker to upload a malicious file, which can then be executed on the system if a victim is tricked into running it [1].

Exploitation

An attacker with network access to the control room and authenticated credentials can upload a specially crafted file. The attacker must also convince a victim (e.g., an operator) to execute that file, potentially through social engineering or by naming it innocuously [1].

Impact

Successful exploitation leads to arbitrary code execution on the system under the context of the victim. The attacker gains the ability to compromise confidentiality, integrity, and availability of the affected system, with a CVSS v3 base score of 5.5 [1].

Mitigation

As of the publication date, IBM has not released a fix or workaround for this vulnerability. The vendor advisory lists no mitigations [1]. Users should monitor for updates and restrict file upload capabilities where possible.