CVE-2017-7722 in Log
Summary
by MITRE
In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH service is accessed with "cmc" and "password" (the default username and password). By exploiting a vulnerability in the restrictssh feature of the menuing script, an attacker can escape from the restricted shell.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/29/2019
The vulnerability identified as CVE-2017-7722 affects SolarWinds Log & Event Manager version 6.3.1 Hotfix 3 and earlier, representing a critical privilege escalation flaw within the system's secure shell implementation. This vulnerability specifically targets the restrictssh feature that is designed to limit user access to a restricted shell environment when connecting via SSH service. The flaw manifests when administrators connect to the system using the default credentials "cmc" and "password" which are commonly known and often left unchanged in production environments. The security mechanism that should prevent unauthorized command execution fails due to improper input validation and shell escape handling within the menuing script.
The technical exploitation of this vulnerability occurs through a specific path where the restrictssh functionality contains a flaw that allows command injection or shell escape mechanisms. When users authenticate with the default credentials, they are presented with a menu system that should restrict their access to only approved commands and functionalities. However, the menuing script contains a vulnerability that enables attackers to bypass these restrictions and gain access to a full shell environment. This represents a classic shell escape vulnerability where the system's attempt to contain user actions fails due to insufficient sanitization of user inputs or improper handling of shell command execution within the restricted environment.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with complete control over the affected system. Once an attacker successfully escapes the restricted shell, they gain access to all system resources, can execute arbitrary commands, and can potentially escalate privileges further to achieve system-level control. This vulnerability directly violates the principle of least privilege and undermines the security architecture that relies on restricted shell environments to prevent unauthorized access to sensitive system functions. The default credentials "cmc" and "password" significantly amplify the risk as many organizations fail to change these defaults, creating an easy entry point for attackers. The vulnerability affects the integrity and confidentiality of log data and system configurations that the SolarWinds LEM platform manages, potentially exposing sensitive information and allowing persistent access to the network infrastructure.
Organizations should immediately implement mitigations including changing default credentials, disabling unnecessary SSH access, and applying the available hotfix version 6.3.1 Hotfix 4. The vulnerability aligns with CWE-20, which describes improper input validation, and relates to ATT&CK techniques involving privilege escalation and command execution. System administrators should also implement network segmentation, monitor SSH access logs for suspicious activity, and consider implementing additional authentication controls such as two-factor authentication to prevent unauthorized access to the system. Regular security audits should verify that default credentials have been changed and that the restrictssh functionality is properly configured to prevent similar escape mechanisms from being exploited in the future.