CVE-2019-14224: Authenticated Remote Code Execution in Alfresco Community

By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution. The attacker must use Alfresco to:

• Upload malicious Solr configuration files to a known/discoverable location
• Create a Solr Core which will trigger a JMX connection from the victim back to the attacker
• Host a malicious RMI server that will send a malicious Java object that results in deserialization and code execution.

NVD Disclosure:

The disclosure for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Access and valid user credentials for the Alfresco Admin Console
• Access to the Alfresco WebDAV or Alfresco Share
• Access to the Alfresco Solr interface

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Information: