[0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High)
Posted by disclosure via Fulldisclosure on Oct 200day Rubbish Research Team is publicly disclosing a vulnerability in Royal
Render 9.1.26b, the closed-source render-farm job manager for VFX and
animation studios from Binary Alchemy (proprietor Holger Schoenberger) of
Ludwigsburg, Germany. Royal Render
is a different product from the Royal Server gateway sold by Royal Apps GmbH
of Austria; the two are unrelated companies sharing one word in their names,
and this disclosure concerns the German...
