CVE-2024-23793

What it actually does

Path traversal in the file upload feature allows authenticated users to write arbitrary files, including executable scripts, to directories served by the web server.

Why it matters to the business

Successful exploitation can lead to remote code execution on the OTRS server, enabling attackers to compromise the helpdesk system, access sensitive ticket data, or disrupt operations; low EPSS and no known exploitation in the wild reduce immediate urgency but patching remains important given the broad affected version range.

How an attack unfolds

An authenticated agent or customer user crafts a file upload request containing path traversal sequences in the filename to place a malicious Perl script in a web-accessible directory, then triggers execution by requesting the script via the web server.

How to fix it

Upgrade OTRS to a version newer than 7.0.49, 2024.3.2 or the latest 2023/2024 maintenance release; upgrade ((OTRS)) Community Edition to a version newer than 6.0.34; restrict file upload permissions and sanitize filenames until patches are applied.

How to confirm the fix worked

Verify installed version against the fixed releases, review web server document root for unexpected uploaded files, and test upload functionality with traversal payloads in a non-production environment.

Typical attack path

1. Obtain authenticated session as an agent or customer user
2. Submit a crafted file upload containing directory traversal sequences such as ../ in the filename
3. Upload a malicious script (e.g., Perl) to a web-server-accessible location
4. Access the uploaded file via HTTP to execute arbitrary code on the server

How to detect it

Inspect web server logs and application upload logs for requests containing directory traversal sequences in filenames or unexpected file extensions; search file systems for recently created scripts in web directories.

• ../
• ..\
• .pl
• upload.*filename.*\.\./

What your security team should do

• Apply the latest OTRS maintenance updates immediately to all affected instances
• Audit and restrict file upload permissions for agents and customers
• Enable strict filename validation and content-type checks on uploads
• Monitor web server access and error logs for path traversal patterns