PT-2021-20131 · Ipfire · Ipfire

Published 2021-06-09 · Updated 2022-07-12 · CVE-2021-33393

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IPFire version 2.25-core155

Description The issue is related to the ownership of certain files, specifically /var/ipfire/backup/bin/backup.pl, which may not be owned by the root account. This could potentially allow an unprivileged account to install a malicious script that is later executed by root. Similar problems with the ownership and permissions of other files may also be present.

Recommendations For IPFire version 2.25-core155, ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account to prevent potential exploitation. As a temporary workaround, consider restricting access to the backup.pl script until the issue is resolved. Additionally, review the ownership and permissions of other files to identify and address any similar problems.

Exploit

Fix

Related Identifiers

CVE-2021-33393

Affected Products

Ipfire

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ipfire_pakfire_exec.rb · Exploit
• 🔥 https://github.com/MucahitSaratar/ipfire-2-25-auth-rce · Exploit
• 🔥 http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/49869 · Exploit
• https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-33393 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33393 · Vendor Advisory
• https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17 · Note
• https://t.me/cvenotify/16063 · Telegram Post
• https://t.me/cvenotify/16044 · Telegram Post