PT-2021-20812 · Fidelis · Fidelis Network/Deception

B0Yd + 1 · Published 2021-06-25 · Updated 2022-08-12 · CVE-2021-35049

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Fidelis Network and Deception versions prior to 9.3.7 Fidelis Network and Deception version 9.4

Description: The issue allows authenticated command injection through the web interface, enabling a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session.

Recommendations: For versions prior to 9.3.7, update to version 9.3.7 or later to address the issue. For version 9.4, apply the available patches and updates to resolve the vulnerability. As a temporary workaround, consider restricting access to the web interface until a patch is applied.

Exploit

Fix

SQL injection

OS Command Injection

Weakness Enumeration

CWE-89

CWE-78

Related Identifiers

CVE-2021-35049

Affected Products

Fidelis Network/Deception

References · 5

• 🔥 https://securifera.com/blog/2021/06/24/operation-eagle-eye · Exploit
• https://osv.dev/vulnerability/CVE-2021-35049 · Vendor Advisory
• https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35049 · Security Note
• https://t.me/cibsecurity/25704 · Telegram Post