Insecure Deserialization in Uniong WebITR

WebITR, developed by Uniong, is affected by an insecure deserialization vulnerability identified as CVE-2026-113404. This vulnerability arises because the application utilizes a hard-coded cryptographic key to handle serialized objects. An authenticated remote attacker can exploit this weakness by crafting custom serialized payloads signed with the hard-coded key. When submitted to the application, the server deserializes these objects, resulting in arbitrary code execution on the underlying host. This flaw is critical for defenders because it permits full system compromise from a standard authenticated user session, bypassing standard application-level access controls.

Impact

Successful exploitation allows for remote code execution on the server hosting the WebITR application. This impact is significant as it grants the attacker the privileges of the service account running the application, which could lead to full system takeover, lateral movement, or data exfiltration. The threat is categorized with a CVSS v3.1 base score of 8.8.

Recommendation

• Monitor application logs for anomalous serialized data inputs or unexpected process execution spawned by the WebITR service account.
• Implement strict ingress filtering for the WebITR application to limit authentication to trusted IP ranges.
• Apply security patches provided by Uniong as soon as they become available for CVE-2026-113404.
• Ensure the service account running the WebITR application follows the principle of least privilege to minimize the impact of successful code execution.