Rapid7 finds Archibus auth bypass, database read and RCE flaws
Rapid7 says a legacy DWR endpoint in Eptura Archibus let it run workflow rules without credentials, chain that into a full database read, and reach remote code execution through an insecure file upload.
Rapid7 says it found three vulnerabilities in Eptura's Archibus building and real estate management platform, and that they have been fixed. The company published the findings on Oct 19, crediting Marcus Chang, a security consultant at Rapid7, who found them during continuous red teaming through Rapid7's Vector Command service.
The first flaw is an authentication bypass in the Archibus Web Central application, which uses Java Direct Web Remoting (DWR) for API calls. DWR runs several method calls from one request in sequence on the same thread. Rapid7 says the isPasswordUppercase method is allowed before login and sets a core system user session on that thread, which the runWorkflowRule method then accepts as authenticated. The result, per Rapid7, is that workflow rules can run without any credentials.
The second flaw lets a user read any database table, including usernames and passwords, through a workflow rule. Rapid7 says it can be chained with the bypass to read data without authentication, and that database write and delete operations may also be possible but were not tested.
The third is an insecure file upload that leads to remote code execution. Rapid7 says an attacker with HTTP access to the server could run system commands as NT AUTHORITY/Local Service and take control of the host.
Rapid7 rates the bypass 8.6 High, the database read 8.5 High and the upload 9.6 Critical. It says the issues affect Archibus versions before 2025.02.
For defenders, the practical step is to confirm which Archibus build is running and move to the fixed release. Because the bypass needs no login, network access to the web server is the main exposure, so limiting who can reach it reduces risk while upgrades are scheduled. Rapid7 also advises checking database accounts and secrets reachable from the application.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
