An unauthenticated remote code execution vulnerability exists in Tipray Data Leakage Prevention System 1.0 due to improper validation of file uploads.

The application fails to restrict file extensions on the uploadWxFile.do endpoint, allowing an attacker to upload arbitrary files, including malicious JSP files, directly to the web application root directory. This flaw is accessible to unauthenticated remote attackers.

The ability to upload arbitrary files to the web root grants an attacker the ability to execute arbitrary code on the underlying server. This represents a critical security failure that can lead to complete system compromise, theft of sensitive data, and long term persistence within the network. Given the CVSS score of 7.3, this vulnerability poses a high risk to organizational operations and data confidentiality.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the uploadWxFile.do endpoint at the network or web server level. Disable the affected functionality if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at uploadWxFile.do, particularly those containing suspicious filename extensions or unexpected content types.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block multipart requests containing suspicious file extensions or direct path traversal attempts targeting the web application directory.

Public Exploit Available: Yes, a functional proof of concept exists and is documented in the referenced security research.

The presence of a publicly available proof of concept for this arbitrary file upload vulnerability necessitates immediate attention. Organizations utilizing Tipray Data Leakage Prevention System 1.0 must assume the risk of server takeover is imminent and implement strict network-level access controls or disable the vulnerable interface until the vendor provides a formal security update.