Progress ShareFile Pre-Authentication RCE Chain via CVE-2026...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701
• Blog Title: Progress ShareFile Pre-Authentication RCE Chain via CVE-2026-2699 and CVE-2026-2701
• Suggested Section: Pentesting Web → Login Bypass and File Upload; add an ASP.NET Execution-After-Redirect subsection and cross-reference unsafe archive extraction and executable upload destinations

🎯 Content Summary

Overview

watchTowr discovered and chained two vulnerabilities in Progress ShareFile Storage Zone Controller 5.x to achieve unauthenticated remote code execution:

• CVE-2026-2699 / WT-2026-0006: authentication bypass caused by CWE-698: Execution After Redirect (EAR).
• CVE-2026-2701 / WT-2026-0007: post-authentication RCE caused by unrestricted storage-path configuration combined with unsafe ZIP extraction that preserves...

  🔧 Technical Details

  Execution-after-redirect authentication bypass: In ASP.NET, HttpResponse.Redirect(path, false) creates a redirect but does not terminate page execution. Calling CompleteRequest() is also not equivalent to stopping the page lifecycle. If protected functionality relies on this sequence, an unauthenticated client can ignore the 302 redirect and access content or actions executed after the failed authentication check. Detection should focus on large 30x response bodies, protected HTML appended after an Object moved response, and redirect helpers that pass false as the termination argument.

  Frontend-only old-secret validation: A configuration page may request an old password or passphrase while the backend fails to verify it for particular trust-changing operations. If an attacker reaches that workflow, they can replace cryptographic settings, redirect a subordinate node to a malicious primary ser...

  🤖 Agent Actions

  Updated src/pentesting-web/login-bypass/README.md with:

  • ASP.NET Execution-After-Redirect root cause and testing workflow.
  • Redirect(..., false) / CompleteRequest() lifecycle explanation.
  • Raw-response detection commands and source-review guidance.
  • Cross-references to archive extraction, file-upload, and IIS writable-webroot techniques.
  • ShareFile non-destructive detection guidance.
  • Numbered citations to watchTowr, Microsoft, MITRE, and the DAG repository.

  Validation passed with git diff --check and citation/reference checks. mdbook was unavailable, so the full build was skipped.

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/youre-not-supposed-to-sharefile-with-everyone-progress-sharefile-pre-auth-rce-chain-cve-2026-2699-cve-2026-2701

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web → Login Bypass and File Upload; add an ASP.NET Execution-After-Redirect subsection and cross-reference unsafe archive extraction and executable upload destinations".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0