PT-2021-22430 · Cachet · Cachet

Thomas Chauchefoin · Published 2021-08-27 · Updated 2022-12-13 · CVE-2021-39172

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.5.1

Description Cachet is an open source status page system. Authenticated users, regardless of their privileges, can exploit a new line injection in the configuration edition feature and gain arbitrary code execution on the server. This issue was addressed by improving UpdateConfigCommandHandler and preventing the use of new lines characters in new configuration values.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 to resolve the issue. As a temporary workaround, only allow trusted source IP addresses to access the administration dashboard.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2021-39172

GHSA-9JXW-CFRH-JXQ6

Affected Products

Cachet

References · 10

• 🔥 https://github.com/W1ngLess/CVE-2021-39172-RCE · Exploit
• 🔥 https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection · Exploit
• https://osv.dev/vulnerability/GHSA-9jxw-cfrh-jxq6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39172 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39172 · Vendor Advisory
• https://github.com/fiveai/Cachet · Note
• https://github.com/fiveai/Cachet/commit/6442976c25930cb370c65a22784b9caee7ed1de2 · Note
• https://github.com/fiveai/Cachet/releases/tag/v2.5.1 · Note
• https://github.com/fiveai/Cachet/security/advisories/GHSA-9jxw-cfrh-jxq6 · Note
• https://t.me/cvenotify/20293 · Telegram Post