PT-2022-16669 · Fidelis · Fidelis Network/Deception

Published 2022-05-17 · Updated 2022-05-26 · CVE-2022-24394

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fidelis Network and Deception versions prior to 9.4.5

Description The issue allows authenticated command injection through the web interface using the filename parameter with the value "update checkfile". This could enable a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response via an authenticated session.

Recommendations For versions prior to 9.4.5, update to version 9.4.5 or later to address this issue. As a temporary workaround, consider restricting access to the web interface or limiting the use of the filename parameter to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-24394

Affected Products

Fidelis Network/Deception

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-24394 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24394 · Vendor Advisory
• https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411 · Vendor Advisory
• https://t.me/cvenotify/30761 · Telegram Post
• https://t.me/cibsecurity/42866 · Telegram Post