Remote Code Execution in Eclipse RAP on Windows

CVE-2023-4760

What is CVE-2023-4760?

A vulnerability in Eclipse RAP allows an attacker to exploit the FileUpload component to execute arbitrary code on Windows systems. This occurs due to improper handling of file names in the FileUploadProcessor.stripFileName method, where backslashes in file paths are not adequately sanitized. Consequently, attackers can upload malicious files to web applications hosted on Tomcat servers. For example, a crafted file path such as /....\webapps\shell.war can result in the file being stored improperly, exposing the system to potential remote code execution threats. It is crucial for users of affected Eclipse RAP versions to implement security measures and apply available patches to mitigate this risk.

References