antsle antman up to 0.9.0 Web Management Console /login ProcessBuilder username=>/password=%0a access control

Summaryinfo

A vulnerability categorized as critical has been discovered in antsle antman up to 0.9.0. The affected element is the function ProcessBuilder of the file /login of the component Web Management Console. Such manipulation of the argument username=>/password=%0a leads to access control. This vulnerability is traded as CVE-2018-7739. The attack may be launched remotely. Furthermore, there is an exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in antsle antman up to 0.9.0. It has been rated as critical. Affected by this issue is the function ProcessBuilder of the file /login of the component Web Management Console. The manipulation of the argument username=>/password=%0a with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This allows obtaining root permissions within the web management console, because the login process uses Java's ProcessBuilder class and a bash script called antsle-auth with insufficient input validation.

The bug was discovered 03/07/2018. The weakness was shared 03/07/2018 (Website). The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2018-7739 since 03/06/2018. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068.

A public exploit has been developed by Joshua Bowser and been published immediately after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The code used by the exploit is:

POST /login HTTP/1.1
Host: 10.1.1.7:3000
[snip]
 
username= > &password=%0a

Upgrading to version 0.9.1a eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44262). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• antsle

Name

• antman

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion