PT-2017-13253 · Aerohive · Hivemanager Classic

Guly + 1 · Publicado 2017-09-01 · Atualizado 2017-09-13 · CVE-2017-14105

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HiveManager Classic versions through 8.1r1

Description The issue allows arbitrary JSP code execution by modifying a backup archive before a restore. This is possible because the restore feature does not validate pathnames within the archive. An authenticated, local attacker, even one restricted as a tenant, can exploit this by adding a JSP file at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps, which will then be exposed at the web interface.

Recommendations For versions through 8.1r1, consider restricting access to the restore feature and validating pathnames within backup archives to prevent arbitrary JSP code execution. As a temporary workaround, consider disabling the restore feature until a proper validation mechanism is implemented.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-14105

Produtos afetados

Hivemanager Classic

Referências · 3

• 🔥 https://github.com/theguly/CVE-2017-14105 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14105 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14105 · Nota de Segurança