PT-2017-13253 · Aerohive · Hivemanager Classic

Guly + 1 · Published 2017-09-01 · Updated 2017-09-13 · CVE-2017-14105

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HiveManager Classic versions through 8.1r1

Description The issue allows arbitrary JSP code execution by modifying a backup archive before a restore. This is possible because the restore feature does not validate pathnames within the archive. An authenticated, local attacker, even one restricted as a tenant, can exploit this by adding a JSP file at HiveManager/tomcat/webapps/hm/domains/$yourtenant/maps, which will then be exposed at the web interface.

Recommendations For versions through 8.1r1, consider restricting access to the restore feature and validating pathnames within backup archives to prevent arbitrary JSP code execution. As a temporary workaround, consider disabling the restore feature until a proper validation mechanism is implemented.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-14105

Affected Products

Hivemanager Classic

References · 3

• 🔥 https://github.com/theguly/CVE-2017-14105 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14105 · Security Note