PT-2020-15626 · Vmware+1 · Vmware Tools+1

Published 2020-09-17 · Updated 2021-07-21 · CVE-2020-24045

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TitanHQ SpamTitan Gateway version 7.07

Description A sandbox escape issue was discovered, allowing an attacker to bypass the restricted shell by presenting a fake vmware-tools ISO image to the guest virtual machine. This ISO image must contain a valid Perl script at the vmware-freebsd-tools/vmware-tools-distrib/vmware-install.pl path. The script will be executed with super-user privileges when the option to install VMware Tools is selected in the main menu of the restricted shell. The script's contents can be customized by the attacker, potentially leading to the installation of a backdoor or similar malicious software.

Recommendations For TitanHQ SpamTitan Gateway version 7.07, as a temporary workaround, consider disabling the option to install VMware Tools in the restricted shell to prevent the execution of the vulnerable script until a patch is available. Restrict access to the vmware-install.pl script to minimize the risk of exploitation.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-24045

Affected Products

Spamtitan Gateway

Vmware Tools

References · 6

• 🔥 https://sensepost.com/blog/2020/clash-of-the-spamtitan · Exploit
• https://osv.dev/vulnerability/CVE-2020-24045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24045 · Security Note
• https://titanhq.com · Vendor Advisory
• https://twitter.com/felmoltor · Note
• https://github.com/felmoltor · Note