SysAid On-Premise Path Traversal Leads to Code Execution
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
To reduce immediate risk, isolate SysAid servers from public internet access and restrict network communication to only essential internal services. Implement strict network egress filtering to prevent data exfiltration or command-and-control communication from the SysAid host. Enhance monitoring for unusual file creation or modification within the Tomcat webroot and unexpected process execution originating from the SysAid service account.
The permanent resolution is to upgrade SysAid On-Premise to version 23.3.36 or a later secure release immediately. All SysAid On-Premise installations prior to version 23.3.36 are affected and vulnerable. After upgrading, conduct a thorough forensic analysis of the SysAid server to detect and eradicate any persistent attacker presence, as this vulnerability has been actively exploited in the wild.
This critical path traversal vulnerability allows an unauthenticated attacker to write arbitrary files to the Tomcat webroot on the SysAid server. This capability can be leveraged for remote code execution (RCE), granting the attacker full control over the underlying system. The consequences include data exfiltration, system compromise, service disruption, or deployment of further malicious payloads like ransomware, severely impacting business operations.
Other CVEs affecting sysaid