PT-2014-6182 · Bmc · Bmc Track-It!

Published 2014-10-10 · Updated 2023-08-02 · CVE-2014-4872

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BMC Track-It! version 11.3.0.355

Description The issue allows remote attackers to upload arbitrary files, execute arbitrary code, or obtain sensitive credential and configuration information without requiring authentication on TCP port 9010. This can be achieved via a .NET Remoting request to API endpoints such as "FileStorageService" or "ConfigurationService".

Recommendations For BMC Track-It! version 11.3.0.355, as a temporary workaround, consider restricting access to TCP port 9010 to minimize the risk of exploitation. Additionally, restrict access to the "FileStorageService" and "ConfigurationService" API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2014-4872

Affected Products

Bmc Track-It!

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/trackit_sql_domain_creds.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/trackit_file_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35032 · Exploit
• 🔥 https://exploit-db.com/exploits/34924 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4872 · Security Note
• https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt · Note
• http://kb.cert.org/vuls/id/121036 · Note
• http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html · Note