CVE-2022-28005

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server (via /Electron/download directory traversal in conjunction with a path component that uses backslash characters), leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITY\SYSTEM on Windows installations. NOTE: this issue exists because of an incomplete fix for CVE-2022-48482.

Se ha detectado un problema en 3CX Phone System Management Console versiones anteriores a 18 Actualización 3 FINAL. Un atacante no autenticado podría abusar del acceso asegurado inapropiadamente a archivos arbitrarios en el servidor, conllevando a una divulgación de credenciales en texto sin cifrar. Luego, el atacante autenticado es capaz de cargar un archivo que sobrescribe un binario de servicio 3CX, conllevando a una ejecución de código remota como NT AUTHORITY\SYSTEM en instalaciones Windows. Las versiones anteriores a 18, Hotfix 1 Build 18.0.3.461 March 2022, son propensas a un acceso adicional no autenticado al sistema de archivos C:\Windows\System32