PT-2021-5321 · Commvault · Commvault Commcell

Brandon Perry + 2 · Published 2021-06-30 · Updated 2023-06-26 · CVE-2021-34994

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Commvault CommCell version 11.22.22

Description This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class and results from the lack of proper validation of a user-supplied string before executing it as JavaScript code. An attacker can leverage this issue to escape the JavaScript sandbox and execute Java code in the context of NETWORK SERVICE.

Recommendations For Commvault CommCell version 11.22.22, as a temporary workaround, consider disabling the DataProvider class until a patch is available. Restrict access to the DataProvider class to minimize the risk of exploitation. Avoid using user-supplied strings in the affected JavaScript code until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

BDU:2021-06149

CVE-2021-34994

ZDI-21-1329

Affected Products

Commvault Commcell

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-1329 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34994 · Security Note
• https://bdu.fstec.ru/vul/2021-06149 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021112404 · Note
• https://t.me/cvenotify/25454 · Telegram Post