PT-2020-16492 · Sentrifugo · Sentrifugo

Published 2020-11-12 · Updated 2020-11-17 · CVE-2020-26804

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2

Description The issue affects the "Upload Attachment" functionality under the "Organization -> Announcements" tab, where users can share announcements and upload attachments. This functionality is vulnerable to "Unrestricted File Upload", allowing an attacker to upload malicious files and potentially control the server.

Recommendations For Sentrifugo version 3.2, consider disabling the "Upload Attachment" functionality until a patch is available to prevent the upload of malicious files. Restrict access to the "Organization -> Announcements" tab to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-26804

Affected Products

Sentrifugo

References · 5

• 🔥 https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26804 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26804 · Vendor Advisory
• https://t.me/cvenotify/5694 · Telegram Post
• https://t.me/cibsecurity/16256 · Telegram Post