4MOSAn GCB Doctor - Unrestricted Upload of File

Vulnerability

The file upload function in 4MOSAn GCB Doctor version 20210811(2.0) and earlier lacks proper user privilege control. An attacker can upload arbitrary files, including webshell files, without authentication. This endpoint is exposed without any access control checks [1].

Exploitation

A remote attacker with network access to the GCB Doctor application can send a crafted HTTP request to the file upload endpoint. No authentication or prior privileges are required. The attacker can upload a webshell or other malicious files, then access the uploaded file to execute arbitrary commands [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the server. This can lead to full system compromise, including unauthorized data access, modification, deletion, or denial of service. The CVSS score is 9.8 (Critical) [1].

Mitigation

The vendor released version 20210916(2.0) to fix this issue. Users should update immediately. No workaround is documented in the available references [1].