A critical remote code execution vulnerability in Aranda Service Desk Web Edition allows authenticated attackers to gain full control over the server environment.

This vulnerability is an improper validation of uploaded files flaw within the ASDK API. By sending a crafted POST request to the /ASDKAPI/api/v8.6/item/addfile endpoint, an authenticated attacker can upload a malicious web.config file to alter the server execution context, ultimately resulting in remote code execution.

The ability for an authenticated user to achieve remote code execution poses a severe risk to organizational data and infrastructure integrity. A successful exploit grants the attacker total control over the affected server, potentially leading to unauthorized data access, lateral movement within the network, and complete system compromise. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent malicious activity.

Immediate Action: Update Aranda Service Desk to version 8.30.6 or later, which contains the official vendor fix for this vulnerability.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the /ASDKAPI/api/v8.6/item/addfile endpoint, particularly those involving web.config files.

Compensating Controls: Implement strict file upload restrictions and ensure the application pool identity has minimal permissions to prevent unauthorized configuration changes or file execution in the upload directory.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub as referenced in the CVE record.

Given the availability of a public proof-of-concept and the high impact of remote code execution, organizations using Aranda Service Desk must prioritize this update. Administrators should verify their current version and patch to 8.30.6 immediately to eliminate the risk of server compromise.