CVE-2021-48014

Summary

FineReport 9.0 has a path traversal flaw (CWE-22) in the unauthenticated /WebReport/ReportServer/design_save_svg endpoint, allowing attackers to write arbitrary files—including JSP webshells—by injecting directory traversal sequences in the filePath parameter, leading to remote code execution.

Exploitability

Exploitation is trivial for unauthenticated attackers due to lack of authentication, no input sanitization on filePath, and publicly available proof-of-concept exploits.

Blast radius

Successful exploitation grants full system compromise (RCE) with no user interaction required, enabling data theft, lateral movement, or persistent backdoor access across the affected reporting server and potentially connected systems.

Detection

Look for POST requests to /WebReport/ReportServer containing filePath parameters with %2e%2e or .. sequences and a __CONTENT__ field with JSP code (e.g., <%@ page ... %>), especially from unauthenticated sources; also monitor for unexpected .jsp file creation under the web root or report server directories.

Prioritized remediation

Upgrade to FineReport version 10.0 or later, as the vendor confirmed the vulnerability is fixed starting in that release; until then, disable the design_save_svg endpoint or restrict network access to it via firewall rules.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.