PT-2017-3498 · Trustwave · Trustwave Secure Web Gateway

Maor Shwartz · Published 2017-12-26 · Updated 2019-10-03 · CVE-2017-18001

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trustwave Secure Web Gateway (SWG) versions prior to 11.8.0.28

Description The issue is related to errors in cryptographic key management. It allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access. This can be achieved via the publicKey parameter to the "/sendKey" URI.

Recommendations For Trustwave Secure Web Gateway (SWG) versions prior to 11.8.0.28, update to version 11.8.0.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the /sendKey URI to minimize the risk of exploitation. Avoid using the publicKey parameter in the affected HTTP POST request until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

CWE-320

Related Identifiers

BDU:2018-00326

CVE-2017-18001

Affected Products

Trustwave Secure Web Gateway

References · 7

• 🔥 https://blogs.securiteam.com/index.php/archives/3550 · Exploit
• 🔥 https://exploit-db.com/exploits/44047 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2017/Dec/88 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18001 · Security Note
• https://trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18001 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00326 · Security Note