PT-2020-17188 · Urve · Urve

Published 2020-12-23 · Updated 2022-09-02 · CVE-2020-29552

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions URVE Build 24.03.2020

Description An issue was discovered in URVE. By using the " internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root.

Recommendations As a temporary workaround, consider restricting access to the " internal/pc/vpro.php" endpoint until a patch is available. Avoid using the mac, ip, operation, usr, and pass parameters in the affected API endpoint until the issue is resolved. Restrict the ability to execute Powershell commands through the vulnerable substring to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-29552

Affected Products

Urve

References · 11

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-040.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Dec/47 · Exploit
• 🔥 http://packetstormsecurity.com/files/160722/URVE-Software-Build-24.03.2020-Authentication-Bypass-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-29552 · Vendor Advisory
• https://urve.co.uk/system-rezerwacji-sal · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29552 · Security Note
• https://t.me/cvenotify/7655 · Telegram Post
• https://t.me/cvenotify/7757 · Telegram Post
• https://t.me/cvenotify/7935 · Telegram Post
• https://t.me/cibsecurity/21234 · Telegram Post
• https://t.me/cvenotify/35618 · Telegram Post