CVE-2022-29517

What it actually does

CVE-2022-29517 is a path traversal vulnerability in the HelpdeskActions.aspx edittemplate functionality of Lansweeper 10.1.1.0. An authenticated attacker with low privileges can craft an HTTP request that manipulates file paths to upload arbitrary files outside the intended template location. If the uploaded file is placed in a web-accessible or executable directory, the issue can lead to remote code execution through a web shell or other server-side payload, as well as unauthorized file modification, data access, and service disruption.

Why it matters to the business

Successful exploitation can give an attacker control over the Lansweeper application server, potentially exposing asset inventory data, credentials or integration secrets available to the application, and internal network reconnaissance information. Because Lansweeper commonly has broad visibility into enterprise assets, compromise can materially aid lateral movement and follow-on attacks. The CVSS score is high, public exploit maturity is listed as available, and the EPSS score indicates meaningful likelihood of exploitation, so exposed or internet-reachable deployments should be treated as urgent even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first obtains or uses a low-privileged Lansweeper account that can reach the vulnerable helpdesk template editing functionality. They then send a crafted request to HelpdeskActions.aspx using the edittemplate action and path traversal sequences to escape the expected template directory. The request uploads attacker-controlled content, commonly a server-executable script or web shell, into a location where the web server can serve or execute it. The attacker then browses to the uploaded file to execute commands in the context of the Lansweeper web application or its underlying IIS application pool account. From there, they may enumerate Lansweeper configuration, retrieve sensitive inventory data, harvest credentials or tokens accessible to the application, modify application files, or pivot to other internal systems.

How to fix it

Upgrade Lansweeper to a version that contains the vendor fix for this vulnerability. Because no fixed version was provided in the input, consult Lansweeper security advisories and release notes and upgrade to the latest supported release rather than remaining on 10.1.1.0. If immediate upgrade is not possible, restrict network access to the Lansweeper web interface, especially HelpdeskActions.aspx, to trusted administrative networks; require strong authentication and MFA where supported; remove unnecessary helpdesk/template editing privileges; block uploads of server-executable extensions such as .aspx, .ashx, .asmx, .config, .ps1, .bat, .cmd, and .exe; and ensure the web server cannot execute user-editable or uploadable content directories. Review file system permissions so the Lansweeper application identity cannot write to application code directories unless strictly required.

How to confirm the fix worked

Confirm the installed Lansweeper version is newer than the vulnerable 10.1.1.0 release and matches the vendor-fixed release line. Validate that HelpdeskActions.aspx and template-editing features are not reachable from untrusted networks. Review application and web server configuration to confirm uploaded or edited template content cannot be written outside intended directories and cannot execute as server-side code. Perform a controlled, authorized test using benign traversal payloads to verify path traversal is rejected and that attempts to upload executable file types are blocked. Check IIS and application logs for post-remediation attempts against HelpdeskActions.aspx with traversal sequences or suspicious upload parameters.

Typical attack path

1. Identify a Lansweeper instance and confirm access to the web interface.
2. Authenticate with a low-privileged account or use previously stolen credentials.
3. Access the vulnerable HelpdeskActions.aspx edittemplate functionality.
4. Submit a crafted HTTP request containing path traversal sequences and attacker-controlled file content.
5. Write the file outside the intended template directory, ideally into a web-accessible executable path.
6. Request the uploaded file over HTTP to execute the payload or confirm write access.
7. Use the resulting access to enumerate application configuration, collect sensitive data, deploy persistence, or move laterally.

How to detect it

Review IIS logs, reverse proxy logs, WAF logs, Lansweeper application logs, Windows Security logs, Sysmon telemetry, and endpoint detection data from the Lansweeper server. Focus on HTTP POST requests to HelpdeskActions.aspx, especially those referencing edittemplate and containing path traversal patterns such as ../, ..\, URL-encoded traversal, or attempts to write files with executable extensions. Look for unusual 200, 201, 302, or 500 responses following upload attempts, then subsequent GET requests to newly created .aspx, .ashx, .asmx, or other executable files. On disk, inspect Lansweeper web application directories, IIS web roots, temporary directories, and upload/template directories for recently created or modified files that do not match the normal product baseline. Investigate web server child processes spawning command interpreters or scripting tools such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, or rundll32.exe. If suspicious activity is found, preserve logs and file timestamps, collect the uploaded files for malware analysis, and assume credentials and integration secrets available to the Lansweeper application may be compromised.

• HelpdeskActions.aspx
• edittemplate
• POST /HelpdeskActions.aspx
• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• ..%2f
• ..%5c
• .aspx
• .ashx
• .asmx
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• certutil.exe
• bitsadmin.exe
• mshta.exe
• rundll32.exe
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe

What your security team should do

• Prioritize upgrading Lansweeper to the latest supported fixed release, especially for internet-accessible or broadly reachable instances.
• Inventory all Lansweeper deployments and verify whether any are running version 10.1.1.0 or other affected builds.
• Restrict access to the Lansweeper web application to trusted networks, VPN users, or administrative jump hosts.
• Audit Lansweeper user accounts for unnecessary helpdesk/template editing permissions and remove excessive privileges.
• Review IIS web roots and Lansweeper application directories for unexpected recently created or modified executable files.
• Hunt web server logs for requests to HelpdeskActions.aspx containing traversal sequences, upload indicators, or suspicious file extensions.
• Rotate secrets, API keys, integration credentials, and service account passwords accessible to Lansweeper if exploitation is suspected.
• Add SIEM detections for suspicious POST requests to HelpdeskActions.aspx and execution of newly uploaded ASP.NET files.