CyberRota Analysis
AI-GeneratedCentreStack versions prior to 17.3 are vulnerable to an unauthenticated deserialization flaw in GSNamespace.dll, enabling attackers to create arbitrary local OS user accounts by exploiting exposed API endpoints with a crafted base64-encoded XML string. This vulnerability can lead to unauthorized access and manipulation of the server filesystem, posing a significant risk to system integrity. Organizations using affected Windows systems should prioritize patching to mitigate potential exploitation.
Original NVD Description
CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with attacker-controlled credentials and create arbitrary directories on the server filesystem.