PT-2018-12640 · Red Hat+1 · Red Hat Ceph Storage+1

Realasmo · Publicado 2018-10-09 · Atualizado 2023-02-13 · CVE-2018-14649

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Ceph Storage versions 2 and 3

Description The issue allows unauthenticated attackers to access a debug shell and escalate privileges. This is due to the ceph-isci-cli package using python-werkzeug in debug shell mode, enabled by setting debug=True in the /usr/bin/rbd-target-api file. Once connected to the debug shell, attackers can execute arbitrary commands remotely with the same privileges as the user running the application, which in the case of Red Hat Ceph Storage 2 and 3, is root level.

Recommendations For Red Hat Ceph Storage versions 2 and 3, consider disabling the debug shell mode in the python-werkzeug library as a temporary workaround until a patch is available. Restrict access to the /usr/bin/rbd-target-api file to minimize the risk of exploitation. Avoid using the ceph-isci-cli package with root level permissions until the issue is resolved.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2018-14649

RHSA-2018:2837

RHSA-2018:2838

Produtos afetados

Red Hat Ceph Storage

Python-Werkzeug

Referências · 9

• 🔥 https://github.com/ceph/ceph-iscsi-cli/issues/120 · Exploit
• https://github.com/ceph/ceph-iscsi-cli/pull/121/commits/c3812075e30c76a800a961e7291087d357403f6b · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2838 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14649 · Aviso do Fabricante
• https://access.redhat.com/articles/3623521 · Aviso do Fabricante
• http://securityfocus.com/bid/105434 · Nota
• https://osv.dev/vulnerability/CVE-2018-14649 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14649 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:2837 · Aviso do Fabricante