# Critical Vulnerability: SysAid CVE-2023-47246

Path traversal in SysAid UserEntry doPost accountID parameter lets attackers write a zlib-compressed WAR webshell to the Tomcat webroot, achieving RCE.

- Payout: Real-world hack
- Severity: critical
- Program: SysAid
- Credited: Huntress
- Disclosed: 2023-11-10
- CVE: CVE-2023-47246
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/critical-vulnerability-sysaid-cve-2023-47246
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-sysaid-cve-2023-47246
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:incomplete-fix technique:source-review vuln:file-upload vuln:path-traversal vuln:rce

**Target:** SysAid on-premise server (Apache Tomcat, com.ilient.server.UserEntry)
**Root cause:** The accountID POST parameter is concatenated into the file write path (a2) without sanitization, allowing ../ traversal; the request body is zlib-inflated and written to that path.
**Steps:**
1. Decompile SysAid Java classes and diff versions 23.3.35 vs 23.3.36 to spot new path-traversal check in UserEntry.doPost
2. Craft POST to the UserEntry endpoint with `accountID` containing `../` traversal targeting `C:\Program Files\SysAidServer\tomcat\webapps\usersfiles\`
3. Set request body to a zlib-compressed WAR webshell
4. Server inflates body and writes it as a file at the traversed path
5. Request the deployed WAR URL to execute the webshell and gain RCE
**How found:** Huntress decompiled Java class files and examined the patch differential between 23.3.35 and 23.3.36; a new error message in doPost referencing the a2 variable (built from accountID) revealed the path traversal, confirmed by reading line 385/421 file-write logic.
**Exploitation:** Attacker sends a POST with a traversal-laden accountID and a zlib-compressed WAR body; SysAid writes the WAR into the Tomcat webapps webroot, then the attacker browses to it to run commands. Post-exploitation PowerShell (child of java.exe) checks for Sophos processes, runs user.exe (GraceWire) with a 64-char hex victim key, then deletes the WAR stager and scrubs log4j/Tomcat log entries matching regexes.
**Escalation:** Post-exploitation PowerShell stages GraceWire loader, evades Sophos AV, and cleans logs to remove forensic traces.
**Insight:** Patch-diffing decompiled Java between adjacent versions surfaces new validation checks; a fresh error string near a file-write sink is a strong signal of a traversal-to-file-write primitive, especially when the body is decompressed and written verbatim.