PT-2020-16302 · Openmediavault · Openmediavault

Anastasios Stasinopoulos + 1 · Published 2020-10-02 · Updated 2022-01-06 · CVE-2020-26124

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions openmediavault versions prior to 4.1.36 openmediavault versions 5.x prior to 5.5.12

Description The issue allows authenticated PHP code injection attacks via the sortfield POST parameter of "rpc.php", due to the lack of json encode safe usage in config/databasebackend.inc. This can lead to arbitrary command execution on the underlying operating system as root.

Recommendations For openmediavault versions prior to 4.1.36, update to version 4.1.36 or later. For openmediavault versions 5.x prior to 5.5.12, update to version 5.5.12 or later. As a temporary workaround, consider restricting access to the "rpc.php" endpoint to minimize the risk of exploitation. Avoid using the sortfield parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-26124

Affected Products

Openmediavault

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/openmediavault_rpc_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/160223/OpenMediaVault-rpc.php-Authenticated-PHP-Code-Injection.html · Exploit
• https://github.com/openmediavault/openmediavault/commit/ebb51bbf5a39f4955eab0073bf87f2a31926d85d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26124 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26124 · Vendor Advisory
• https://openmediavault.org/?p=2797 · Vendor Advisory