Ahsay CBS Auth Bypass RCE

CVE-2026-105133 + CVE-2026-105134 — Unauthenticated remote code execution in AhsayCBS ≤10.3.4

Technical analysis covering root cause, exploitation, and indicators of compromise is available on the Horizon3.ai attack research blog:

AhsayCBS versions 10.3.4 and earlier are vulnerable to unauthenticated remote code execution via two chained authentication bypass and path traversal flaws in the JSON API and replication receiver modules. An attacker can achieve full administrative control or direct RCE without credentials.

Vulnerability Details

CVE-2026-105133: Authentication Bypass in JSON API

The com.ahsay.obs.api.json.JSONApi.execute() method skips the checkSysPwd() credential validation when the JSON request body contains {"FromServlet":"Y"} . This allows any unauthenticated attacker to invoke every JSON API action without credentials.

Impact: Unauthenticated JSON API access to sensitive operations.

CVE-2026-105134: Path Traversal in Replication Upload

The replication receiver file upload endpoint ( PUT /rps/obs7/rpsfile/upload ) constructs the write path from attacker-controlled UserHome and TopDir headers via getReplicatedPath() without applying the com.ahsay.c path denylist. An attacker can traverse into Tomcat's web-served directory ( ../../webapps/ ) to upload executable JSP files.

Mode 1: Admin Takeover (Default)

Uses the authentication bypass to create a new system administrator account. Works on any AhsayCBS installation, regardless of licensing or replication configuration.

Mode 2: Replication RCE (--replication)

Uses the path traversal in the replication receiver to upload an authenticated webshell. Requires the target to be licensed and configured as a replication receiver. Achieves RCE as the service account.

Test if the target is vulnerable without making any changes:

Create a new administrative account:

Execute commands via a temporary webshell:

Follow Horizon3.ai Attack Team for Latest Security Research

"This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems except where explicitly authorized." Project maintainers assume no liability for misuse. Use responsibly.