Eptura Archibus RCE Lets Attackers Steal DB Secrets and Run System Commands

Rapid7 security researchers identified three vulnerabilities in Eptura Archibus, a facility management platform used by thousands of organisations. The most severe flaw allows unauthenticated remote code execution, giving attackers full control of the server.

What happened

Marcus Chang, a security consultant at Rapid7, discovered these issues during red teaming exercises. A legacy API endpoint in the Web Central application permits authentication bypass. This flaw carries a CVSS score of 8.6, rated as high severity. Attackers can exploit Java Direct Web Remoting to chain method calls.

The isPasswordUppercase method sets a system session without requiring credentials. The runWorkflowRule method then uses this privileged session. This sequence allows malicious actors to execute arbitrary workflow rules. Rapid7 tested specific rules that expose sensitive data and allow file uploads.

An insecure file upload function leads to remote code execution. This critical flaw has a CVSS score of 9.6. Attackers with network access via HTTP can execute system commands. These commands run under the NT AUTHORITY/Local Service account.

Why it matters

Eptura states that over 16,000 companies used Archibus in 2023. This includes forty percent of the Fortune 500. The platform manages physical buildings, equipment and real estate leases. A breach could expose maintenance records and lease information.

Attackers can read secrets and passwords directly from the database. The AbCommonResources-getDataRecords workflow enables full database reads. This high-severity flaw scores 8.5 on the CVSS scale. Combined with the authentication bypass, data exfiltration requires no valid credentials.

Next steps

• Identify all instances of Eptura Archibus in your network inventory.
• Verify if systems are exposed to unauthenticated HTTP traffic from external networks.
• Monitor for unusual DWR API requests or batch method calls.
• Review access logs for successful workflow executions without prior authentication.

Detection notes

Security teams should monitor web server logs for anomalous DWR API activity. Look for requests containing multiple method calls in a single batch. Alert on executions of workflow rules that do not follow standard authentication patterns. Check for unexpected file uploads to the server. Investigate any process spawning from the web service context. Contain compromised hosts by isolating them from the network to prevent lateral movement.

What to do and how to stay safe: Eptura

• Restrict network access to Archibus servers to authorised internal subnets only.
• Implement web application firewalls to block suspicious API request patterns.
• Monitor for outbound connections from the web server to unknown external IPs.
• Once the vendor provides an update, apply patches immediately to all affected systems.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of the remote code execution flaw?

The insecure file upload leading to remote code execution is rated Critical with a CVSS score of 9.6.

How does the authentication bypass work?

Attackers chain the isPasswordUppercase method with runWorkflowRule to set a privileged session without credentials.

Which data is at risk?

Attackers can read any database table, including usernames and passwords, via the getDataRecords workflow.