Remote Spark SparkView Path Traversal Vulnerability Leading to Remote Code Execution

A path traversal vulnerability has been identified in Remote Spark's SparkView component, prior to build 1127. This vulnerability allows for reading and writing arbitrary files in all directories with root privileges, ultimately leading to remote code execution. The issue arises within the RDP drive redirection feature and can be exploited by an unauthenticated attacker, depending on the implementation.

Impact

Exploitation of this vulnerability could result in unauthorized access to the file system, allowing an attacker to read or write files as the root user. This could be leveraged to execute malicious code on the server.

Remediation

Users can update to SparkView build 1127 or later, where this vulnerability has been addressed.