caniasERP 8.03 Pre-Auth RCE Chain Analysis and POC (CVE-2026-8214/8216/8217/8215)

caniasERP 8.03 Vulnerability Summary Overview caniasERP 8.03 contains 8 zero-interaction vulnerabilities that allow attackers to achieve Remote Code Execution (RCE) via a Java RMI session hijacking chain without authentication. Core Exploitation Chain: 1. Session Enumeration (CVE-2026-8214): Obtain active session IDs without authentication. 2. Session Hijacking (CVE-2026-8216): Take over a session using the acquired session ID. 3. Command Injection (CVE-2026-8217): Execute arbitrary system commands via the hijacked session. 4. File Reading (CVE-2026-8215): Read arbitrary files on the server to retrieve command output. Other Independent Vulnerabilities: Information Disclosure (CVE-2026-8241): Obtain sensitive information such as server version and architecture. User Profile Disclosure (CVE-2026-8244): Access full user profiles by logging in with empty credentials. Username Enumeration (CVE-2026-8242): Determine if a username exists based on differences in response. Hardcoded Key (CVE-2026-8243): The publicly available JAR package contains hardcoded encryption keys. Impact Scope Target Software: caniasERP 8.03 (ERP platform developed by Industrial Application Software GmbH). Attack Conditions: No credentials required, no prior knowledge needed, and only one open port (JNLP/RMI) is necessary. Privilege Escalation: Executes operating system commands with service account privileges. Remediation The vendor was contacted before publication but did not respond. It is recommended to update the software version or patch the RMI interface authentication mechanism as soon as possible. POC Code Extraction 1. Session Enumeration (CVE-2026-8214) 2. Session Hijacking (CVE-2026-8216) 3. Command Injection (CVE-2026-8217) 4. File Reading (CVE-2026-8215)

Goal Reached Thanks to every supporter — we hit 100%!

caniasERP 8.03 Pre-Auth RCE Chain Analysis and POC (CVE-2026-8214/8216/8217/8215)