Calero VeraSMART Static Machine Key Vulnerability Leading to Remote Code Execution

A remote code execution vulnerability exists in Calero VeraSMART versions prior to 2022 R1. The issue arises from the use of static ASP.NET/IIS machineKey values, which are stored in the application's web.config file. An attacker who retrieves these keys can create a valid ASP.NET ViewState payload that bypasses integrity checks and is accepted by the application. This exploitation leads to server-side deserialization and remote code execution within the context of the IIS application.

Impact

Exploitation of this vulnerability allows for remote code execution on the server, executed in the context of the IIS application.