NesterSoft WorkTime allows unauthenticated command injection via API endpoint

Summary

An attacker can access sensitive data or take control of the server by exploiting a security weakness in the WorkTime API. This is a serious issue that allows a malicious person to execute commands on the server with full access. Users should update WorkTime to the latest version to fix this vulnerability.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
nestersoft	worktime	<= 11.8.8	–
nestersoft	worktime	<= 11.8.8	–

Original title

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime serv...

Original description

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.

nvd CVSS3.1 9.8

Vulnerability type

CWE-78 OS Command Injection

https://r.sec-consult.com/worktime Third Party Advisory