PT-2021-5649 · Commvault · Commcell

Brandon Perry + 2 · Published 2021-06-30 · Updated 2022-01-22 · CVE-2021-34996

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Commvault CommCell versions 11.22.22

Description The issue is related to incorrect code generation management in the Demo ExecuteProcessOnGroup process of the CommCell storage management software. Exploitation of this issue can allow a remote attacker to execute arbitrary code by sending a specially crafted request. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The flaw exists within the Demo ExecuteProcessOnGroup workflow, allowing an attacker to specify an arbitrary command to be executed, potentially executing code in the context of SYSTEM.

Recommendations For Commvault CommCell version 11.22.22, consider disabling the Demo ExecuteProcessOnGroup workflow as a temporary workaround until a patch is available. Restrict access to the workflow to minimize the risk of exploitation. Avoid using the workflow to execute arbitrary commands until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-749

CWE-94

Related Identifiers

BDU:2022-00087

CVE-2021-34996

ZDI-21-1331

Affected Products

Commcell

References · 6

• https://zerodayinitiative.com/advisories/ZDI-21-1331 · Security Note
• https://bdu.fstec.ru/vul/2022-00087 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34996 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34996 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021112404 · Note
• https://t.me/cvenotify/25452 · Telegram Post