Unauthenticated Remote Code Execution in MyReport Updater via gRPC

Report One MyReport Updater, in versions 2.1.1 and earlier, exposes an unauthenticated gRPC service listening on TCP port 9095. This service provides methods that can be accessed by any network-adjacent attacker without authentication. Specifically, the UpdateConfigReferent method is vulnerable to manipulation, allowing an attacker to force the updater to pull update module archives from an attacker-controlled remote server. Because the application fails to adequately validate the authenticity of the update source, the updater will accept malicious module archives as long as the attacker provides matching MD5 digests. This flaw allows for arbitrary file writes, resulting in code execution with SYSTEM privileges on the affected host. Given the elevated permissions of the updater service, this vulnerability poses a critical risk to systems running MyReport Updater.

Impact

The vulnerability allows unauthenticated remote attackers to gain full control over the affected system. Since the updater runs with SYSTEM privileges, the impact includes complete compromise of the host, potential lateral movement within the network, and the deployment of persistent malicious modules. This affects all organizations utilizing MyReport Updater versions 2.1.1 or earlier.

Recommendation

1. Patch immediately: Upgrade all instances of MyReport Updater to a version beyond 2.1.1 as soon as the vendor provides a security update.
2. Network isolation: Restrict inbound access to TCP port 9095 to authorized management subnets only; the service should not be exposed to untrusted networks.
3. Monitoring: Monitor for unexpected network connections originating from the host running the MyReport Updater service, especially outbound connections to unknown or non-official update servers.