Calero VeraSMART versions prior to 2022 R1 use static ASP.NET/IIS machineKey values configured for the VeraSMART web application and stored in C:\\Program Files (x86)\\Veramark\\VeraSMART\\WebRoot\\web.config. An attacker who obtains these keys can craft a valid ASP.NET ViewState payload that passes integrity validation and is accepted by the application, resulting in server-side deserialization and remote code execution in the context of the IIS application.
The VeraSMART application stores static, immutable machineKey values in the file C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config. These keys are used to sign and verify the integrity of ASP.NET ViewState objects. By knowing these values, an attacker can craft a malicious ViewState payload that will pass server-side integrity verification. Submitting such a payload to the application results in server-side deserialization and code execution in the context of the IIS process (RCE).
An unauthenticated remote attacker can obtain full code execution (RCE) in the context of the IIS service account, which in practice means the ability to take control of the application server, steal data, and perform further lateral movement in the network.
Calero VeraSMART should be updated to version 2022 R1 or later. If immediate update is not possible, network access to the web application interface should be restricted and access to the web.config file should be secured to prevent disclosure of machineKey values. Detailed information is available in the vendor's references.
Calero VeraSMART in versions prior to 2022 R1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCalero Verasmart
APPCalero2022.0< 2022.0