caniasERP 8.03 Pre-Auth RCE via Java RMI Session Hijacking and Command Injection

caniasERP 8.03 Vulnerability Summary Vulnerability Overview caniasERP 8.03 contains 8 zero-interaction vulnerabilities that allow fully unauthorized remote code execution (RCE) via a Java RMI session hijacking chain, without requiring authentication. Attack Path: 1. Session Enumeration: Obtain all active session IDs via . 2. Session Hijacking: Exploit to accept any session ID as a parameter without validating ownership. 3. Command Injection: Execute Troia scripts via (which invokes at the lower level). 4. Data Exfiltration: Read arbitrary files from the server (e.g., configuration files, credentials) via . Key Characteristics: No credentials, no prior knowledge, and only one open port required. The attack surface is the Java RMI protocol, exposed via JNLP files. Auxiliary vulnerabilities include hardcoded keys, information disclosure, and username enumeration. Impact Scope Affected Product: caniasERP 8.03 Affected Components: Java RMI interface ( , , , , , , ) JNLP deployment endpoints CVSS Score: Max 7.3 (Session Management), 6.3 (Command Injection), 5.3 (Multiple Components) CWE Types: CWE-287: Improper Authentication CWE-78: OS Command Injection CWE-22: Path Traversal CWE-285: Improper Authorization CWE-204: Response Discrepancy CWE-321: Hard-coded Key Remediation Vendor Response: The page notes that "the vendor was contacted prior to publication but did not respond in any way." Recommended Actions**: 1. Patch all listed CVEs immediately (CVE-2026-8214, 8215, 8216, 8217, 8241, 8242, 8243, 8244). 2. Implement strong authentication and authorization checks for Java RMI interfaces. 3. Fix command injection vulnerabilities by strictly filtering and escaping user inputs. 4. Remove hardcoded keys and adopt a secure key management solution. 5. Restrict file read permissions to prevent arbitrary file reads. 6. Standardize response formats to prevent username enumeration via response discrepancies. POC / Exploit Code 1. Session Enumeration (CVE-2026-8214) 2. Session Hijacking (CVE-2026-8216) 3. OS Command Injection (CVE-2026-8217) 4. Arbitrary File Read (CVE-2026-8215) 5. Auxiliary Vulnerability: Server Information Disclosure (CVE-2026-8241) 6. Auxiliary Vulnerability: User Profile Disclosure (CVE-2026-8244) 7. Auxiliary Vulnerability: Username Enumeration (CVE-2026-8242) 8. Auxiliary Vulnerability: Hardcoded Key (CVE-2026-8243)

Goal Reached Thanks to every supporter — we hit 100%!

caniasERP 8.03 Pre-Auth RCE via Java RMI Session Hijacking and Command Injection