PT-2021-3931 · Akkadian · Akkadian Appliance Manager+2

Cale Black + 4 · Published 2021-06-15 · Updated 2021-08-09 · CVE-2021-31580

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Akkadian Provisioning Manager Engine versions prior to 5.0.2 Akkadian OVA appliance versions prior to 3.0 Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0

Description The issue allows an attacker to bypass the restricted shell provided by Akkadian Provisioning Manager Engine by switching the OpenSSH channel from shell to exec and providing a single execution parameter. This could potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Akkadian Provisioning Manager Engine versions prior to 5.0.2, update to version 5.0.2 or later. For Akkadian OVA appliance versions prior to 3.0, update to version 3.0 or later. For Akkadian Appliance Manager versions prior to 3.3.0.314-4a349e0, update to version 3.3.0.314-4a349e0 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-04448

CVE-2021-31580

Affected Products

Akkadian Appliance Manager

Akkadian Ova Appliance

Akkadian Provisioning Manager Engine

References · 6

• 🔥 https://rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure · Exploit
• https://bdu.fstec.ru/vul/2021-04448 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-31580 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31580 · Vendor Advisory
• https://doc.clickup.com/d/h/24t9j-27923/b7180168c8cf855/24t9j-1673 · Note
• https://t.me/cybersecuritytechnologies/3617 · Telegram Post