PT-2022-16663 · Fidelis · Fidelis Deception+5

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24388

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows an attacker with user-level access to the CLI to inject root-level commands into various Fidelis components, including CommandPost, Collector, Sensor, and Sandbox, as well as neighboring components. This is due to a vulnerability in the rconfig "date" feature. Patches and updates are available to address this issue.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the rconfig "date" feature to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-24388

Affected Products

Collector

Commandpost

Fidelis Deception

Fidelis Network

Sandbox

Psensor

References · 4

• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24388 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24388 · Vendor Advisory
• https://t.me/cibsecurity/42880 · Telegram Post