CVE-2024-6117

The meeting management function does not sufficiently verify the type of uploaded files, allowing an authenticated user to upload a crafted file with an ASP extension. After the file is placed on the server, the attacker can invoke it through a browser or HTTP request, resulting in execution of the contained code on the server side. In this way, it is possible to run arbitrary system commands in the context of the web server process.

An attacker with access to a user account can take control of the server by executing arbitrary system commands remotely (RCE), which may lead to data theft, backdoor installation, privilege escalation, or disruption of system availability.

Security patches available from the vendor should be applied according to references. Additionally, it is recommended to restrict access to file upload functionality only to trusted users and implement server-side file type validation mechanisms (whitelist of allowed extensions and MIME types).

Hamastar MeetingHub Paperless Meetings 2021