PT-2022-16665 · Fidelis · Fidelis Network/Deception

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24390

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows an attacker with user-level access to the CLI to inject user-level commands into Fidelis Network and Deception components, including CommandPost, Collector, Sensor, and Sandbox, as well as neighboring components. This is due to a vulnerability in the rconfig "remote text file". Patches and updates are available to address this issue.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "remote text file" in the rconfig to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-24390

Affected Products

Fidelis Network/Deception

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-24390 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24390 · Vendor Advisory
• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory
• https://t.me/cvenotify/30757 · Telegram Post
• https://t.me/cibsecurity/42862 · Telegram Post