Remove YiShaAdmin Versions 2.2 Through 3.1 to Stop Unauthenticated File Deletion

Attackers can delete critical system files on YiShaAdmin servers without needing valid login credentials. This capability stems from a path traversal vulnerability in versions 2.2 through 3.1 that exposes sensitive data and allows remote removal of files. The flaw was rated high severity with a CVSS score of 8.8 by the National Vulnerability Database.

The vulnerability resides in the /admin/File/DownloadFile endpoint of the YiShaAdmin application. By manipulating the filePath parameter, attackers can send crafted requests that traverse directory structures. Setting a specific delete parameter within these requests enables the removal of arbitrary files. This mechanism allows unauthorized access to sensitive system resources such as the etc/passwd file.

Exploitation Evidence and Timeline

Evidence of active exploitation was first observed by the Shadowserver Foundation on October 20, 2023. This observation confirms that the vulnerability is being targeted in the wild rather than remaining theoretical. The unauthenticated nature of the attack means any exposed server is at immediate risk. Attackers do not need to bypass authentication mechanisms to exploit this specific endpoint.

Affected Software Versions

The vulnerability affects YiShaAdmin versions 2.2 through 3.1. The software is developed by liukuo362573. According to the National Vulnerability Database, the issue was addressed in commit 025b062. Users running any version within the 2.2 to 3.1 range are vulnerable. Upgrading to a version containing the fix is the primary mitigation strategy.

What to watch

Monitor network logs for unusual GET requests targeting file download endpoints. Watch for patterns indicating directory traversal attempts in web server access logs. Verify that your YiShaAdmin installation is not exposing the /admin/File/DownloadFile endpoint to the public internet. Ensure that server configurations restrict access to administrative interfaces.

What made it possible

Path traversal vulnerabilities occur when software fails to properly validate user-supplied file paths. This weakness allows attackers to escape the intended directory structure and access files elsewhere on the system. In intrusion scenarios, this technique serves as an initial access or privilege escalation vector. Teams usually check whether input validation is missing on file handling functions. Reviewing how applications process file requests helps identify similar risks.

Background: Privilege escalation vulnerabilities

Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.

Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks

What to do and how to stay safe: YiShaAdmin

• Verify if your organization uses YiShaAdmin versions 2.2 through 3.1 and isolate affected systems immediately.
• Apply the security patch provided in commit 025b062 or upgrade to a version that includes this fix.
• Monitor web server logs for unauthorized access attempts to administrative file endpoints.
• Restrict network access to administrative interfaces to prevent unauthenticated exploitation.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of YiShaAdmin are vulnerable to CVE-2022-51022?

YiShaAdmin versions 2.2 through 3.1 are affected by this high-severity path traversal vulnerability.

Do attackers need to log in to exploit this flaw?

No, the vulnerability allows unauthenticated attackers to exploit the system without valid credentials.

When was exploitation of this vulnerability first observed?

The Shadowserver Foundation first observed exploitation evidence on October 20, 2023.