Critical · published October 10, 2025
🚨 One crafty request to '/ProjectCenter.rem' can allow an attacker to execute arbitrary code with system-level privileges — that's like handing over the keys to your entire project! 🔥 Think of this vulnerability as a delivery service that accepts any package without checking who sent it. If an unauthorized courier could drop off anything inside your office, it could lead to chaos, right? With this bug, a remote attacker could swoop in and execute any command they wish on your server, potentially compromising sensitive data or disrupting operations entirely. The worst part? They can do this without even a password, leaving your defenses in shambles!
Think of this vulnerability as a delivery service that accepts any package without checking who sent it. If an unauthorized courier could drop off anything inside your office, it could lead to chaos, right? This vulnerability in Newforma Project Center Server allows unauthenticated users to send serialized .NET data through the '/ProjectCenter.rem' endpoint, executing arbitrary code with 'NT AUTHORITY\NetworkService' privileges. This means attackers could run any code as a service account, which often has broad access rights.
With this bug, a remote attacker could swoop in and execute any command they wish on your server, potentially compromising sensitive data or disrupting operations entirely. The worst part? They can do this without even a password, leaving your defenses in shambles! To protect against this vulnerability, restrict network access to the NPCS endpoint, ensuring it's only available within your internal network. Additionally, consider implementing proper input validation and reviewing your overall security architecture to prevent unauthorized access. 🔒 You've got this! Follow these steps, and you'll have your defenses up in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| newforma/project_center | all versions | — |