Flexsense DiskBoss Unauthenticated File Upload Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Flexsense DiskBoss version 7.7.14. This issue allows unauthenticated attackers to upload arbitrary files through the 'Directory' field in the 'Search Files' command. Exploiting this vulnerability causes the application to crash.

Impact

Exploitation of this vulnerability leads to a crash of the DiskBoss application, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by uploading a file through the 'Directory' field in the 'Search Files' command. This can be done by copying a payload into the clipboard, opening the DiskBoss application, and pasting the clipboard content into the 'Directory' field. After confirming the input, the application will crash.