dxrvs/vaultize_cve-2024-36079Proof-of-concept exploit for CVE-2024-36079, demonstrating arbitrary file upload in Vaultize DRM v21.07.27 via path traversal, enabling SSH key injection for system access.
The on-premise Vaultize DRM v.21.07.27 is vulnerable to the upload of arbitrary files.
Files whose names contain part of the absolute path of the file system may be uploaded due to the lack of filename filtering. 
When you try to download the files 
the application creates a temporary file located in the final path in the file system. 
The file exists until downloading is complete, then it is deleted. This makes it possible for an attacker to write an arbitrary file to any directory with the rights of the application.
One form of product distribution is to deliver a pre-built VMware virtual machine image with the on-premise version of the application installed. In this case, it is possible to gain access to the system by uploading the ssh public key.
