[carlospolop]

Blog URL

https://rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed

Blog Title

Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)

Blog high summary

Rapid7 found CVE-2026-107186 in Archibus Web Central: DWR batches execute sequentially on one thread, so pre-auth isPasswordUppercase(PROJECT_ID) seeds a privileged core session and runWorkflowRule reuses it. Any HTTP-reachable instance can be attacked after obtaining a JSESSIONID, scriptSessionId, and PROJECT_ID, bypassing workflow authorization.

getDataRecords (CVE-2026-107187) can dump afm_users; writeHTMLtoFile (CVE-2026-107188) writes attacker-controlled .jspx to a browsable directory. Requesting it executes JSPX as NT AUTHORITY/Local Service, enabling RCE. Update to Archibus 2025.02+.

PR changes

• src/pentesting-web/403-and-401-bypasses.md: Added the batched-RPC thread-local identity failure mode, response-interpretation caveat, and links to related API and upload coverage.
• src/pentesting-web/file-upload/README.md: Added the executable-extension access-policy mismatch in export workflows and linked it to the authorization failure.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

Rapid7’s original research supports the retained mechanisms and response-interpretation caveat. Existing pages cover cross-request thread-local reuse and executable upload extensions, but not these within-batch and report-writer distinctions. The directory link and references placement were repaired; the original examples were preserved.

Head: 541bc5612261a083c2b65642012e00161de13db7

[carlospolop]

merge