CVE-2008-0457

published 2008-02-07

CVE-2008-0457: Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System…

Priority P2 64 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
symantec	backupexec_system_recovery	—	—
symantec	backupexec_system_recovery	—	—

Detection & IOCs extracted from sources · hover to see the quote

url :8443/axis/FileUpload↗

port 8443↗

path /axis/FileUpload↗

• → Monitor for unauthenticated multipart/form-data POST requests to the /axis/FileUpload endpoint on port 8443 of the Symantec LiveState Apache Tomcat server. ↗
• → Alert on JSP files being written to the web server filesystem via the FileUpload class, as exploitation results in remote code execution with SYSTEM-level privileges. ↗
• → Detect arbitrary file uploads to any server path via the FileUpload endpoint; the 'Remote Path' parameter allows the attacker to specify the destination directory. ↗

• · The exploit targets Symantec Backup Exec System Recovery Manager versions 7.0 and 7.0.1 specifically; the vulnerable endpoint is the FileUpload class on the bundled Symantec LiveState Apache Tomcat server. ↗
• · The vulnerability is unauthenticated (unauthorized); no credentials are required to reach the /axis/FileUpload endpoint. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20