# Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus

DWR batch call to pre-auth isPasswordUppercase sets a core system session on the thread, letting runWorkflowRule run unauthenticated, enabling DB read and JSPX webshell RCE.

- Payout: Research
- Severity: critical
- Program: Eptura Archibus
- Credited: Marcus Chang
- Disclosed: 2026-10-19
- CVE: CVE-2026-107186, CVE-2026-107187, CVE-2026-107188
- Write-up quality: 9/10
- Original: https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed
- Tags: domain:web impact:data-leak impact:rce kind:research platform:threat-intel sev:critical tech:java technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** Archibus Web Central DWR endpoint (/archibus/dwr/call/plaincall/)
**Root cause:** DWR processes multiple method calls sequentially on one thread; the pre-auth-whitelisted isPasswordUppercase calls loadTableDef which sets a privileged core user session in the thread-local ContextStore, which runWorkflowRule then trusts for authentication.
**Steps:**
1. Obtain JSESSIONID by browsing /archibus/login.axvw
2. Get scriptSessionId via POST /archibus/dwr/call/plaincall/__System.generateId.dwr with page=%2Farchibus%2Flogin.axvw
3. Get PROJECT_ID via POST /archibus/dwr/call/plaincall/SecurityService.getProjects.dwr
4. Send POST /archibus/dwr/call/plaincall/Multiple.2.dwr with callCount=2: c0=SecurityService.isPasswordUppercase(PROJECT_ID), c1=workflow.runWorkflowRule(RULE_NAME, params)
5. For DB read: c1-param0=AbCommonResources-getDataRecords with tableName=afm_users, fieldNames=['afm_users.user_name','afm_users.user_pwd'], restriction=1=1
6. For RCE: c1-param0=AbCommonResources-writeHTMLtoFile with html=<JSPX webshell>, fileExtension=jspx; response returns browsable path
7. Browse to /archibus/schema/per-site/exportReports/DataViewReport<TIMESTAMP>.jspx to execute
**How found:** Red teaming via Rapid7 Vector Command; noticed DWR supports batched multi-call requests and that isPasswordUppercase was whitelisted pre-auth while internally calling loadTableDef which sets a core user session on the thread-local ContextStore, then tested runWorkflowRule in the same batch.
**Exploitation:** Chain the auth bypass with writeHTMLtoFile to write a JSPX webshell to a browsable exportReports directory, then GET the file to execute commands as NT AUTHORITY/Local Service; alternatively use getDataRecords to dump afm_users credentials.
**Escalation:** Auth bypass -> arbitrary workflow execution -> DB credential dump and JSPX webshell upload -> RCE as Local Service -> server control.
**Insight:** When a framework batches RPC calls on one thread, look for pre-auth-whitelisted methods that mutate thread-local/context state (session, tenant, user) — a later call in the same batch inherits that state. Also test alternate extensions (jspx vs jsp) against auth filters on uploaded files.