TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Project Discovery

Remote Code Execution in DELMIA Apriso

2025-09-23 · Read original ↗

ATT&CK techniques detected

5 predictions
T1190Exploit Public-Facing Application
95%
“intended only for administrators or trusted integrations. vulnerable http request : http 1post / apriso / messageprocessor / flexnetmessageprocessor. svc http / 1. 1 2content - type : text / xml ; charset = utf - 8 3host : { { hostname } } 4soapaction : " http : / / tempuri. org …”
T1190Exploit Public-Facing Application
75%
“createobject ( " scripting. filesystemobject " ) 15 fso. deletefile server. mappath ( request. servervariables ( " script _ name " ) ), true 16 set fso = nothing 17 % > access the web shell at / apriso / portal / uploads / webshell. asp in the same authenticated session, to make …”
T1190Exploit Public-Facing Application
73%
“roleid > 33 < / employeerole > 34 < / employee > 35 < / flexnet _ employees > an attacker can send the above crafted soap request to create a new user with arbitrary credentials ( e. g., username : last, password : 9 in this case ) without authentication. the xml payload allows s…”
T1190Exploit Public-Facing Application
50%
“remote code execution in delmia apriso table of contents introduction delmia apriso is a manufacturing execution and operations orchestration platform used by large manufacturers, service providers, and critical infrastructure operators. because the product exposes multiple integ…”
T1059.007JavaScript
41%
“remote code execution in delmia apriso table of contents introduction delmia apriso is a manufacturing execution and operations orchestration platform used by large manufacturers, service providers, and critical infrastructure operators. because the product exposes multiple integ…”

Summary

Introduction DELMIA Apriso is a manufacturing execution and operations orchestration platform used by large manufacturers, service providers, and critical infrastructure operators. Because the product exposes multiple integration points (SOAP, file uploads, provisioning feeds) that are often reachable from internal networks, we performed a focused black-box assessment to surface integration and surface-area weaknesses. Our testing uncovered two chained, high-impact issues: an unauthenticated S