A critical cross-site request forgery vulnerability in Precurio Intranet Portal 4.4 allows unauthenticated attackers to achieve remote code execution by inducing authenticated users to upload malicious files.

This vulnerability combines cross-site request forgery (CWE-352) with an unrestricted file upload flaw (CWE-434). An attacker can send a crafted request to a profile update endpoint, forcing an authenticated user to perform an action that uploads an executable file to the web server.

The ability to achieve arbitrary code execution on a web server poses a severe threat to organizational security. Successful exploitation could lead to full system compromise, unauthorized access to sensitive intranet data, and potential lateral movement within the network. With a CVSS score of 8.8, this vulnerability represents a high risk that requires immediate attention to prevent operational disruption and data loss.

Immediate Action: Upgrade to the latest version of Precurio Intranet Portal as provided by the vendor, ensuring all security patches are applied to remediate the file upload and CSRF vectors.

Proactive Monitoring: Review web server access logs for anomalous file upload activity or requests originating from unexpected referrers that may indicate CSRF exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to validate request referrers and restrict file upload types to prevent unauthorized or malicious file extensions from being processed by the server.

Public Exploit Available: Yes, a proof-of-concept is linked via the Packet Storm Security reference.

Given the potential for remote code execution and the confirmed existence of a public proof-of-concept, this vulnerability must be treated as a high priority. Administrators should verify their current version of Precurio Intranet Portal immediately and apply the vendor update. If an update cannot be applied instantly, implement strict WAF rules to sanitize uploads and validate request integrity to mitigate the risk of exploitation.