Impact

Successful exploitation leads to full remote code execution on the underlying server hosting SecuShare Pro. This can result in complete system compromise, unauthorized data exfiltration, lateral movement within the network, and the deployment of additional malware or ransomware.

Recommendation

Prioritize the identification of all internet-facing or internal SecuShare Pro instances. Monitor web server logs for suspicious parameter values containing common command injection indicators (e.g., semicolon, pipe, or backtick characters) directed at the application API. Check for unexpected child processes being spawned by the web service process (e.g., cmd.exe, sh, bash) and investigate any suspicious outbound network activity originating from the application server.