PT-2022-11809 · Code42 · Crashplan For Small Business+5

Published 2022-01-20 · Updated 2022-07-12 · CVE-2021-43269

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Code42 app versions prior to 8.8.0 Incydr Basic versions prior to 8.8.0 Incydr Advanced versions prior to 8.8.0 Incydr Gov F1 versions prior to 8.8.0 CrashPlan Cloud versions prior to 8.8.0 CrashPlan for Small Business versions prior to 8.8.0

Description The issue allows an attacker to change a device's proxy configuration to use a malicious proxy auto-config (PAC) file, leading to arbitrary code execution through eval injection. This affects several Code42 products, excluding Incydr Professional and Enterprise.

Recommendations For Code42 app version prior to 8.8.0, update to version 8.8.0 or later. For Incydr Basic version prior to 8.8.0, update to version 8.8.0 or later. For Incydr Advanced version prior to 8.8.0, update to version 8.8.0 or later. For Incydr Gov F1 version prior to 8.8.0, update to version 8.8.0 or later. For CrashPlan Cloud version prior to 8.8.0, update to version 8.8.0 or later. For CrashPlan for Small Business version prior to 8.8.0, update to version 8.8.0 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-43269

Affected Products

Code42

Crashplan Cloud

Crashplan For Small Business

Incydr Advanced

Incydr Basic

Incydr Gov F1

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-43269 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43269 · Vendor Advisory
• https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories/Arbitrary_code_execution_via_malicious_Code42_app_proxy_configuration · Vendor Advisory
• https://code42.com/r/support/CVE-2021-43269 · Vendor Advisory
• https://t.me/cvenotify/25683 · Telegram Post
• https://t.me/cibsecurity/35906 · Telegram Post