PT-2020-4763 · Rconfig · Rconfig

Matthew Aberegg + 1 · Published 2020-03-23 · Updated 2021-07-21 · CVE-2020-10879

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: rConfig versions prior to 3.9.5

Description: The issue is related to a lack of proper neutralization of special elements used in operating system commands. This can be exploited by a remote attacker using a specially crafted GET request, allowing them to execute arbitrary commands on the target system. The nodeId parameter in lib/crud/search.crud.php is passed directly to the exec function without being escaped, leading to command injection.

Recommendations: For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the lib/crud/search.crud.php file to minimize the risk of exploitation. Avoid using the nodeId parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-05315

CVE-2020-10879

Affected Products

Rconfig

References · 7

• 🔥 https://exploit-db.com/exploits/48241 · Exploit
• https://github.com/rconfig/rconfig/commit/3385f906427d228c48b914625136bf620f4ca0a9 · Patch
• https://osv.dev/vulnerability/CVE-2020-10879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10879 · Security Note
• https://bdu.fstec.ru/vul/2020-05315 · Security Note
• https://t.me/cvenotify/2057 · Telegram Post
• https://cxsecurity.com/issue/WLB-2020030122 · Note