CVE-2018-20221

Vulnerability

Secure/SAService.rem endpoint in Deltek Ajera Timesheets versions prior to and including 9.10.16 performs insecure deserialization of user-supplied data. The vulnerability allows an authenticated attacker to trigger deserialization of arbitrary .NET objects, leading to remote code execution. Affected versions: <= 9.10.16 [1].

Exploitation

An attacker must have valid authentication credentials (e.g., an ASPXAUTH cookie) to access the vulnerable endpoint. The attacker crafts a malicious serialized payload using tools like ysoserial.net and sends it to Secure/SAService.rem. The server then deserializes the payload, executing arbitrary commands in the context of the IIS Application Pool [1].

Impact

Successful exploitation results in remote code execution as the IIS Application Pool user, which typically has high privileges on the web server. This can lead to full compromise of the application and underlying system, including data exfiltration, installation of backdoors, and lateral movement [1].

Mitigation

As of the public disclosure, no official patch or mitigation has been released by Deltek. Users are advised to restrict network access to the vulnerable endpoint, apply the principle of least privilege to the application pool account, and monitor for suspicious activity. Upgrading to a version newer than 9.10.16 may address the issue, but no confirmation is available from the vendor [1].