Unauthenticated archive extraction writes outside its target directory, reaching code execution as SYSTEM

Summary

A web endpoint in the SecureScan log-viewer application accepts an uploaded archive from an unauthenticated caller and extracts it without validating where each entry lands. Archive entry names are used to build the destination path directly, so an entry naming a relative path outside the extraction directory is written to that path instead. No authentication, credentials, or prior access are required.

The endpoint applies no constraint on the file name or extension it writes, which is what separates this from a contained file-write issue: an attacker chooses both the destination and the contents.

Impact

Demonstrated end to end: an unauthenticated request from a separate host caused a file to be written into a directory served by the application, and a subsequent request to that file executed attacker-supplied code as NT AUTHORITY\SYSTEM. The proof used a benign payload that read back the process identity, and was removed afterwards.

Reproduced independently on a pristine installation with no prior test history, driven from a different machine on the network, over plaintext HTTP, with no Authorization header and no credentials of any kind.

Affected

Vendor-stated fix

I have not verified these builds. HP named them but has not provided them to me, so I cannot confirm the issue is closed in either one. The versions above are HP’s statement, not my finding.

Mitigation

Apply the vendor update. Network isolation is worth doing generally, but it does not cleanly apply here. The affected surfaces share their endpoints and ports with traffic that the devices and end users require, so restricting by address or by port removes scanning or print release without removing the exposure. A homegrown control would have to filter each affected request individually and be maintained as the product changes, which is a stopgap rather than a fix.

Technical detail

Held. This issue reproduces on a product line with no available fix, and reproduction code and packet captures are not published while that is the case. This disclosure will be expanded once R3 remediation exists or HP states that R3 is out of support.

Timeline

Credit

Reported by Joseph Chiarchiaro, Independent Security Researcher. CVE assigned and scored by HP Inc. as CNA; the vector HP assigned matches the one submitted.