PT-2021-3233 · Eyesofnetwork · Eyesofnetwork Eonweb

Published 2021-05-24 · Updated 2021-05-28 · CVE-2021-33525

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.3-11

Description The issue is related to the nagios path parameter in lilac/export.php, which does not properly neutralize special elements used in operating system commands. This can be exploited by a remote attacker to execute arbitrary commands. The vulnerability can be exploited via shell metacharacters in the nagios path parameter, as demonstrated by inserting an "&& curl" substring for the shell using %26%26+curl. The exploitation requires authenticated user access.

Recommendations For EyesOfNetwork eonweb versions 5.3-11, consider disabling access to the lilac/export.php endpoint until a patch is available, or restrict the use of the nagios path parameter to prevent the injection of shell metacharacters. Avoid using the nagios path parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-02941

CVE-2021-33525

Affected Products

Eyesofnetwork Eonweb

References · 8

• 🔥 https://github.com/ArianeBlow/LilacPathVUln/blob/main/eon-pwn.sh · Exploit
• https://bdu.fstec.ru/vul/2021-02941 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-33525 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33525 · Vendor Advisory
• https://github.com/EyesOfNetworkCommunity/eonweb/releases · Note
• https://t.me/cvenotify/15166 · Telegram Post
• https://vuldb.com/?id.175582 · Note
• https://t.me/cvenotify/14962 · Telegram Post