Datto Windows Agent up to 1.0.5.0 Command command injection

Summaryinfo

A vulnerability has been found in Datto Windows Agent up to 1.0.5.0 and classified as critical. This issue affects some unknown processing. Performing a manipulation as part of Command results in command injection. This vulnerability is known as CVE-2017-16674. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Datto Windows Agent up to 1.0.5.0. This affects an unknown part. The manipulation as part of a Command leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation, aka an attack with a malformed primary whitelisted command and a secondary non-whitelisted command. This affects Datto Windows Agent (DWA) 1.0.5.0 and earlier. In other words, an attacker could combine this "primary/secondary" attack with the CVE-2017-16673 "rogue pairing" attack to achieve unauthenticated access to all agent machines running these older DWA versions.

The bug was discovered 11/06/2017. The weakness was published 11/09/2017 (Website). The advisory is shared at datto.com. This vulnerability is uniquely identified as CVE-2017-16674 since 11/08/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-109244. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Datto

Name

• Windows Agent

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion