PT-2021-23342 · Sas · Sas/Intrnet

Elwood Buck · Published 2021-11-19 · Updated 2022-04-06 · CVE-2021-41569

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAS/Intrnet versions 9.4 build 1520 and earlier

Description The issue allows Local File Inclusion. The samples library, included by default in the appstart.sas file, enables end-users to access the sample.webcsf1.sas program. This program contains user-controlled macro variables passed to the DS2CSF macro. Users can escape the context of the configured user-controllable variable and append additional functions native to the macro but not included as variables within the library. This includes a function that retrieves files from the host OS.

Recommendations For SAS/Intrnet versions 9.4 build 1520 and earlier, consider disabling access to the sample.webcsf1.sas program until a patch is available. Restrict the use of the DS2CSF macro to minimize the risk of exploitation. Avoid using user-controlled macro variables in the affected library to prevent escaping the context of the configured variable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2021-41569

Affected Products

Sas/Intrnet

References · 7

• 🔥 https://mindpointgroup.com/blog/high-risk-vulnerability-discovery-localfileinclusion-sas · Exploit
• https://osv.dev/vulnerability/CVE-2021-41569 · Vendor Advisory
• https://support.sas.com/kb/68/641.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41569 · Security Note
• https://t.me/cvenotify/23500 · Telegram Post
• https://t.me/cibsecurity/32718 · Telegram Post
• https://t.me/cvenotify/28532 · Telegram Post