PT-2020-12342 · Artica · Artica Proxy

Code16 · Published 2020-03-22 · Updated 2020-06-22 · CVE-2020-10818

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artica Proxy version 4.26

Description The issue allows remote command execution for an authenticated user via shell metacharacters in the hostname field. This can be exploited by including shell metacharacters in the "Modify the hostname" field.

Recommendations For Artica Proxy version 4.26, consider restricting access to the "Modify the hostname" field to prevent the inclusion of shell metacharacters until a patch is available. As a temporary workaround, validate and sanitize user input in the "Modify the hostname" field to prevent command execution.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-10818

Affected Products

Artica Proxy

References · 5

• 🔥 https://code610.blogspot.com/2020/03/rce-in-artica-426.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-10818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10818 · Security Note
• https://t.me/cvenotify/4580 · Telegram Post
• https://t.me/cvenotify/1994 · Telegram Post