A critical path traversal vulnerability in BC Security Empire allows authenticated operators to achieve remote code execution by writing malicious files to arbitrary server paths.

The vulnerability exists in the file upload endpoint, where the application fails to validate the filename parameter. An authenticated operator can inject path traversal sequences to escape the intended directory and overwrite or create files in sensitive system locations.

The ability to write arbitrary files to the server allows an attacker to gain full control over the Empire Command and Control (C2) infrastructure. With a CVSS score of 8.8, this flaw represents a high risk of complete system compromise, potential lateral movement within the network, and the loss of confidentiality and integrity for all managed agents.

Immediate Action: Update BC Security Empire to version 6.7.1 or later to implement proper filename validation and directory containment.

Proactive Monitoring: Review server access logs for unusual filename patterns containing traversal sequences, such as dot-dot-slash strings, and monitor for unauthorized file creation events in directories outside the designated upload path.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal sequences in multipart file upload parameters, providing a temporary layer of protection while updates are scheduled.

Public Exploit Available: Yes, a technical write-up detailing the vulnerable code and the path traversal mechanism is available via the VulnCheck advisory and the official BC Security GitHub repository.

Given the severity of this vulnerability and the potential for full remote code execution, organizations utilizing Empire must prioritize the update to version 6.7.1 immediately. Ensure that access to the C2 management interface is restricted to authorized personnel only, as the vulnerability requires authenticated access to trigger.