PT-2018-8511 · Parallels · Parallels Remote Application Server

Publicado 2018-02-28 · Atualizado 2018-03-23 · CVE-2017-9447

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Parallels Remote Application Server (RAS) version 15.5 Build 16140

Description A vulnerability exists in the web interface due to improper validation of the file path when requesting a resource under the "RASHTML5Gateway" directory. This allows a remote, unauthenticated attacker to exploit the weakness and read arbitrary files from the vulnerable system using path traversal sequences.

Recommendations For Parallels Remote Application Server (RAS) version 15.5 Build 16140, consider restricting access to the "RASHTML5Gateway" directory until a patch is available. As a temporary workaround, limit the ability to request resources under this directory to prevent path traversal attacks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-9447

Produtos afetados

Parallels Remote Application Server

Referências · 4

• 🔥 https://exploit-db.com/exploits/442321 · Exploit
• 🔥 https://blog.runesec.com/2018/02/22/parallels-ras-path-traversal · Exploit
• https://osv.dev/vulnerability/CVE-2017-9447 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9447 · Nota de Segurança