PT-2019-8657 · Vera · Veraedge+1

Mandar Satam · Published 2019-06-17 · Updated 2019-06-20 · CVE-2017-9388

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vera VeraEdge version 1.7.19 Vera Veralite version 1.7.481

Description An issue was discovered in the device firmware file, specifically in the proxy.sh script, which allows the device to proxy requests to and from another website. The url parameter retrieved by this script is not sanitized correctly and is passed to eval to execute curl functionality, allowing an attacker to escape from the executed command and execute any commands of their choice. This is primarily used for communication between the device and the Vera website when the user is logged in to https://home.getvera.com.

Recommendations For Vera VeraEdge version 1.7.19, consider disabling the proxy.sh script until a patch is available. For Vera Veralite version 1.7.481, consider disabling the proxy.sh script until a patch is available. As a temporary workaround, avoid using the url parameter in the affected script until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-9388

Affected Products

Veraedge

Veralite

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-9388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9388 · Security Note
• https://t.me/cibsecurity/4946 · Telegram Post
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html · Note