CVE-2023-47246
SysAid Server Path Traversal Vulnerability
Description
CVE-2023-47246 is a critical path traversal vulnerability in SysAid On-Premise IT service management software that enables remote code execution. By exploiting this flaw, an unauthenticated attacker can write arbitrary files to the Tomcat webroot, achieving full code execution on the SysAid server. This vulnerability was actively exploited in the wild in November 2023 and has been confirmed by CISA as a Known Exploited Vulnerability with a remediation deadline of December 4, 2023. CVE-2023-47246 is particularly dangerous because it has been associated with ransomware campaigns, and its EPSS score of 94.3% indicates near-certain exploitation activity, making immediate remediation of this SysAid path traversal vulnerability essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sysaid | sysaid | < 23.3.36 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://documentation.sysaid.com/docs/latest-version-installation-files(Product)
- https://documentation.sysaid.com/docs/on-premise-security-enhancements-2023(Release Notes, Vendor Advisory)
- https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification(Exploit, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-47246(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
In CVE-2023-47246, the SysAid On-Premise application fails to properly validate file paths in user-supplied requests, allowing attackers to traverse directory structures and write files outside the intended directories. This path traversal weakness enables an attacker to place a malicious web shell in the Tomcat webroot, converting a file write into full remote code execution on the SysAid server.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
Impact Analysis
CVE-2023-47246 carries a CVSS 3.1 score of 9.8 (Critical), representing the highest risk tier for security vulnerabilities. The SysAid path traversal flaw is remotely exploitable without physical access, requires no authentication, demands no user interaction, and has low attack complexity, meaning any network-connected attacker can exploit it with minimal effort. Confidentiality (High): successful exploitation exposes all data managed by the SysAid server, including IT service tickets, credentials, and organizational information. Integrity (High): attackers can modify system files, deploy web shells, and install persistent backdoors on the server. Availability (High): full server compromise allows attackers to disrupt IT service management operations or deploy ransomware. The EPSS score of 94.3% indicates near-certain exploitation, and this vulnerability has been confirmed in ransomware campaigns, amplifying the real-world business impact significantly.
Exploit Maturity
Public exploit information is available for CVE-2023-47246 via the SysAid security advisory, which details the exploitation methodology observed in the wild. CISA has confirmed active exploitation and has added CVE-2023-47246 to the Known Exploited Vulnerabilities catalog, with this vulnerability being explicitly linked to ransomware operations. The EPSS score of 94.3% indicates near-certain exploitation activity, placing it in the 99.9th percentile of all scored vulnerabilities. The description confirms that this vulnerability was exploited in the wild in November 2023, with attackers writing web shells to the Tomcat webroot to achieve remote code execution on SysAid servers.
Remediation
- Apply the vendor patch immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade SysAid On-Premise to version 23.3.36 or later, which addresses the path traversal vulnerability.
- Check for indicators of compromise on existing SysAid installations before and after patching. Review the Tomcat webroot directory for unauthorized files, inspect web server access logs for path traversal patterns (e.g., sequences containing "../"), and look for unexpected web shells or scripts deployed on the server.
- Restrict network access to the SysAid application by placing it behind a reverse proxy or firewall, limiting access to trusted IP ranges, and ensuring the management interface is not exposed to the public internet. Implement input validation and path canonicalization at the web application firewall (WAF) level to block path traversal attempts.
- Review Tomcat and SysAid application logs for evidence of unauthorized file uploads, suspicious HTTP requests targeting file upload endpoints, and any signs of lateral movement originating from the SysAid server.
- Harden the deployment environment by running SysAid with least-privilege service accounts, applying file system permissions that prevent the web application from writing outside its designated directories, and enabling file integrity monitoring on the Tomcat webroot to detect unauthorized modifications.
Technical Details
CVE-2023-47246 exploits an improper limitation of a pathname to a restricted directory (CWE-22) in the SysAid On-Premise application, specifically in versions prior to 23.3.36. The vulnerability allows an unauthenticated attacker to craft HTTP requests containing path traversal sequences that bypass the application's directory restrictions, enabling arbitrary file writes to the underlying Tomcat webroot. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is network-based with low complexity, requires no privileges and no user interaction, making it trivially exploitable by remote attackers. Once an attacker writes a malicious JSP web shell to the Tomcat webroot, they gain full server-side code execution capabilities, which as documented in the November 2023 exploitation campaign, was leveraged to deploy additional payloads and establish persistent access to compromised SysAid environments.
Frequently Asked Questions
Is CVE-2023-47246 being actively exploited?
Yes, CVE-2023-47246 is being actively exploited in the wild and has been confirmed by CISA as a Known Exploited Vulnerability with a remediation deadline of December 4, 2023. This vulnerability has been explicitly linked to ransomware campaigns. The EPSS score of 94.3% places it in the 99.9th percentile, indicating near-certain exploitation.
What products are affected by CVE-2023-47246?
CVE-2023-47246 affects SysAid On-Premise versions prior to 23.3.36. Organizations running any earlier version of the SysAid On-Premise IT service management software are vulnerable to this path traversal and remote code execution attack.
How do I fix CVE-2023-47246?
Upgrade SysAid On-Premise to version 23.3.36 or later immediately. Before and after patching, inspect the Tomcat webroot for unauthorized files and review server logs for signs of compromise. Restrict network access to the SysAid application to trusted IP ranges.
How severe is CVE-2023-47246?
CVE-2023-47246 has a CVSS 3.1 score of 9.8, rated as Critical severity. With an EPSS score in the 99.9th percentile and confirmed ransomware usage, this is among the most dangerous actively exploited vulnerabilities. Immediate patching is essential to prevent full server compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.