TEN - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/ten/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 15:26:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Arbitrary File Read and Write in TEN Frameworkhttps://feed.craftedsignal.io/briefs/2026-09-ten-framework-rce/Fri, 04 Sep 2026 15:26:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-ten-framework-rce/TEN Framework version 0.11.71 contains unauthenticated file read and write vulnerabilities in its API endpoints, enabling remote code execution via file system manipulation.TEN Framework version 0.11.71 is impacted by a critical vulnerability (CVE-2026-85688) affecting the TMAN Designer component. The vulnerability resides in the /api/designer/v1/file-content API endpoints, which fail to properly validate requests. This flaw allows unauthenticated attackers to perform arbitrary file reads and writes on the underlying host system. By sending maliciously crafted POST or PUT requests to these endpoints, an attacker can read sensitive configuration files or overwrite system files. Successful exploitation enables remote code execution through methods such as modifying SSH authorized_keys, appending malicious cron jobs, or injecting code into executable graph files used by the framework. Given the CVSS score of 9.8, this vulnerability poses a severe risk to any internet-exposed TEN Framework instances.

Attack Chain

  1. Attacker performs reconnaissance to identify internet-facing TEN Framework TMAN Designer instances.
  2. Attacker crafts a malicious HTTP POST request targeting the /api/designer/v1/file-content endpoint.
  3. Attacker uses the vulnerability to read local system configuration files to map internal paths.
  4. Attacker constructs a malicious payload, such as a reverse shell script or an SSH public key.
  5. Attacker sends an HTTP PUT request to the same endpoint to overwrite a sensitive system file (e.g., /home/user/.ssh/authorized_keys).
  6. If targeting cron, the attacker writes a malicious job definition to /etc/cron.d/ or /var/spool/cron/.
  7. The system executes the injected code or grants unauthorized access, completing the compromise.

Impact

Successful exploitation leads to full system compromise of the server running TEN Framework. Attackers gain the ability to exfiltrate sensitive data, establish persistent backdoors via SSH keys or cron jobs, and execute arbitrary code with the privileges of the service user. This vulnerability affects all deployments of TEN Framework 0.11.71 and carries a high risk of automated exploitation by threat actors scanning for vulnerable web applications.

Recommendation

  • Immediately upgrade all instances of TEN Framework to a patched version once released by the vendor.
  • Restrict network access to the TMAN Designer API endpoints to trusted administrative IP addresses using a firewall or ingress controller.
  • Audit server logs for unauthorized HTTP POST or PUT requests to /api/designer/v1/file-content.
  • Implement integrity monitoring on critical system files like /home//.ssh/authorized_keys and /etc/cron. to detect unauthorized modifications.
]]>criticaladvisoryvulnerabilityrcewebserver