PT-2019-19404 · Sangfor+1 · Sangfor Sundray Wlan Controller+1

Publicado 2019-04-18 · Atualizado 2020-08-24 · CVE-2019-9161

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sangfor Sundray WLAN Controller versions 3.7.4.2 and earlier

Description The issue allows remote attackers to achieve full access to the system. This is due to the fact that shell metacharacters in the nginx webconsole.php Cookie header can be used to read an etc/config/wac/wns cfg admin detail.xml file containing the admin password. The password for root is the WebUI admin password concatenated with a static string.

Recommendations For Sangfor Sundray WLAN Controller versions 3.7.4.2 and earlier, update to a version later than 3.7.4.2 to resolve the issue. As a temporary workaround, consider restricting access to the nginx webconsole.php endpoint to minimize the risk of exploitation. Avoid using the Cookie header in the affected endpoint until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-9161

Produtos afetados

Sangfor Sundray Wlan Controller

Nginx

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-9161 · Aviso do Fabricante
• http://cnvd.org.cn/flaw/show/CNVD-2019-07679 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-9161 · Nota de Segurança