PT-2016-3247 · Commvault · Commvault

Wchen-R7 · Published 2016-12-08 · Updated 2019-10-03 · CVE-2017-18044

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Commvault versions prior to v11 SP6

Description A Command Injection issue was discovered in the ContentStore/Base/CVDataPipe.dll of Commvault. The issue arises from a message parsing function inside the Commvault service that does not properly validate the input of an incoming string before passing it to CreateProcess. This allows a specially crafted message to inject commands that will be executed on the target operating system. Exploitation of this issue does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon.

Recommendations For Commvault versions prior to v11 SP6, update to version v11 SP6 or later to resolve the issue. As a temporary workaround, consider restricting access to the cvd daemon to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2018-00335

CVE-2017-18044

Affected Products

Commvault

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/pull/9389 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/pull/9340 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/commvault_cmd_exec.rb · Exploit
• 🔥 https://github.com/securifera/CVE-2017-18044-Exploit · Exploit
• https://osv.dev/vulnerability/CVE-2017-18044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00335 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-18044 · Security Note
• https://securifera.com/advisories/sec-2017-0001 · Note