CX-Supervisor up to 3.42 Project File command injection

Summaryinfo

A vulnerability classified as critical was found in CX-Supervisor up to 3.42. Affected by this vulnerability is an unknown functionality. The manipulation as part of Project File results in command injection. This vulnerability is cataloged as CVE-2018-19015. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability classified as critical has been found in CX-Supervisor up to 3.42. Affected is an unknown function. The manipulation as part of a Project File leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application.

The bug was discovered 01/17/2019. The weakness was shared 01/28/2019 by mr_me with Zero Day Initiative (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2018-19015 since 11/06/2018. It is possible to launch the attack remotely. The successful exploitation requires a authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106654†). The entries VDB-129999, VDB-130000, VDB-130001 and VDB-130002 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• CX-Supervisor

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40
• 3.41
• 3.42

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion