Nitroshare Desktop
Monthly
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.
Arbitrary file write in NitroShare Desktop 0.3.4 allows unauthenticated attackers on the same network to plant malicious files on a target system by sending a crafted filename with directory traversal sequences in the JSON item header name field. The vulnerability can be exploited to write to the Windows Startup folder, achieving persistent code execution when the user next logs in. Publicly available exploit code exists but it is not listed in CISA KEV.