Arbitrary File Write in Scirius PCAP Filestore Upload

Scirius versions through 3.8.0 contain a critical vulnerability in the PCAP filestore upload endpoint that permits arbitrary file writes. The flaw originates from insufficient sanitization of the _id field within uploaded JSON documents processed by the endpoint. Authenticated users assigned the default User role can exploit this by injecting path traversal sequences (such as ../) into the _id field. This manipulation allows the application to write attacker-controlled JSON content to arbitrary locations on the host filesystem. Because the application processes these requests with root privileges, this vulnerability enables the creation of malicious files with a .json extension in protected directories, potentially facilitating further exploitation such as configuration manipulation or code execution.

Impact

Successful exploitation allows authenticated low-privileged users to achieve arbitrary file writes with root privileges. This can lead to full system compromise, persistent unauthorized access, or the overwriting of critical system configuration files.

Recommendation

• Upgrade Scirius to a patched version beyond 3.8.0 as soon as the vendor makes a fix available.
• Audit logs for the PCAP filestore upload endpoint for requests containing path traversal characters (e.g., ../) in the _id field.
• Restrict access to the PCAP filestore upload functionality to only authorized administrative accounts.