Hackers Exploit Critical ShowDoc RCE Flaw in Ongoing Attacks

Cybersecurity researchers have highlighted a critical vulnerability in ShowDoc, a widely used online document-sharing platform designed for IT teams.

Tracked as CNVD-2020-26585, this severe security flaw allows unauthenticated remote code execution (RCE) on compromised servers.

The vulnerability poses a significant risk to organizations relying on outdated versions of the software for internal collaboration, as it allows attackers to completely take over the host system.

According to technical documentation and proof-of-concept exploits published on the Vulhub repository, the vulnerability is rooted in an unrestricted file upload mechanism.

ShowDoc versions prior to 2.8.7 fail to properly validate and sanitize files uploaded by users. Because the application does not require authentication to access the upload endpoint, remote threat actors can easily bypass security filters and upload malicious files directly to the server.

Security analysts have demonstrated that exploiting this vulnerability is dangerously simple and requires very little technical sophistication.

Threat actors can launch the attack by sending a specially crafted HTTP POST request to the application’s image upload system.

The technical breakdown of the exploit includes the following steps:

• Attackers target the /index.php?s=/home/page/uploadImg directory to initiate the upload process.
• Malicious payloads, such as PHP webshells, are disguised using basic file extension manipulation. For example, attackers inject angle brackets into the filename, such as test.<>php, to bypass weak extension checks.
• The vulnerable ShowDoc application processes the request without sanitizing the file type and responds with a direct URL to the newly uploaded file.
• The attacker navigates to this exact web address, which triggers the malicious script and grants them arbitrary code execution.

Because this exploit requires zero prior authentication, any threat actor with network access to a vulnerable ShowDoc instance can launch an attack.

Once a webshell is successfully deployed, hackers can execute system-level commands, steal highly sensitive IT documentation, pivot to other internal network assets, or deploy secondary payloads like ransomware.

The proof-of-concept shared by Vulhub confirms that commands execute seamlessly, highlighting the severe impact of this flaw.

To protect network infrastructure against this critical RCE vulnerability, IT and security teams must implement immediate defensive measures.

Mitigation and remediation strategies include:

• Immediately upgrade all ShowDoc deployments to version 2.8.7 or later, which contains the official security patch for this flaw.
• Restrict public internet access to internal document-sharing platforms by placing them behind a secure VPN.
• Deploy a Web Application Firewall (WAF) to automatically detect and block suspicious POST requests targeting image upload directories.
• Actively monitor server logs for unusual file extensions, unexpected PHP execution, or unauthorized access to upload endpoints.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.