PT-2017-18538 · Renci · Irods

Published 2017-05-05 · Updated 2019-10-03 · CVE-2017-8799

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iRODS versions prior to 4.1.11 iRODS versions prior to 4.2.1

Description The issue allows execution of untrusted input via igetwild in iRODS, enabling other users, potentially anonymous, to execute remote shell commands through iRODS virtual pathnames. This can be exploited by retrieving a virtual iRODS pathname containing a semicolon via igetwild, which, being a Bash script, executes the part of the pathname following the semicolon in the user's shell.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 or later. For versions prior to 4.2.1, update to version 4.2.1 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-8799

Affected Products

Irods

References · 3

• https://github.com/irods/irods/issues/3452 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-8799 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8799 · Vendor Advisory