CVE-2021-41790

Vulnerability

The vulnerability resides in the Script Action execution functionality of Hyland Alfresco Content Services. Due to insufficient validation, scripts uploaded to locations outside the Data Dictionary can be executed. Affected versions include org.alfresco:alfresco-content-services up to 5.2.7.11, 6.0.1.9, 6.1.1.10, 6.2.2.18, and 7.0.1.2 [1].

Exploitation

An attacker must be a logged-in user with the ability to upload files. The attacker uploads a script to a location outside the Data Dictionary (e.g., via the Document Library) and then triggers its execution through a Script Action. No special privileges beyond standard user access are required.

Impact

Successful exploitation allows the attacker to execute arbitrary code within a sandboxed environment. Although the sandbox limits the scope of the compromise, it still enables significant control over the Alfresco instance, potentially leading to data access or further attacks.

Mitigation

Hyland has addressed the issue in a later release. Users should upgrade to a version beyond 7.0.1.2 that includes the fix [1]. No workarounds have been publicly disclosed.