A critical deserialization vulnerability in PowerDocu allows unauthenticated attackers to execute arbitrary code by supplying malicious JSON files.

The application utilizes insecure deserialization when parsing JSON files within Flow or App packages. By manipulating the $type property, an attacker can instantiate arbitrary .NET objects and trigger remote code execution.

This vulnerability poses a severe risk to organizational infrastructure, as successful exploitation results in full system compromise. With a CVSS score of 7.8, the potential for unauthorized code execution necessitates immediate attention to prevent data theft, lateral movement, or complete loss of system availability.

Immediate Action: Upgrade PowerDocu to version 2.4.0 or later immediately, as this release contains the necessary security hardening to prevent malicious object instantiation.

Proactive Monitoring: Monitor file system access logs for unusual activity surrounding the parsing of Flow or App packages and review system execution logs for signs of unexpected .NET process spawning.

Compensating Controls: Implement strict file integrity monitoring and restrict the execution of PowerDocu to environments where only trusted, verified JSON configuration files are processed.

Public Exploit Available: No

Given the capability for arbitrary code execution, this vulnerability represents a high risk to any environment utilizing PowerDocu for technical documentation. Security teams should prioritize the update to version 2.4.0 across all instances to eliminate the deserialization vector and ensure the integrity of the underlying host systems.