Docmosis Tornado Remote Code Execution Vulnerability via Crafted Script to UNC Path

A remote code execution vulnerability exists in Docmosis Tornado versions through 2.9.7. The issue arises when a remote attacker sends a crafted script to the UNC path input, exploiting the application's handling of path normalization. This vulnerability can be bypassed by URL encoding certain characters, allowing malicious scripts to be executed.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Docmosis Tornado is running.

Reproduction

To reproduce this vulnerability, send a request to the UNC path input with a script payload. URL encode the payload to bypass the application's input restrictions. After the request is processed, the injected script will be executed on the server.

Remediation

Users can update to Docmosis Tornado version 2.10.0 or later, where this vulnerability has been addressed.