Code42 Enterprise/Crashplan for Small Business Client up to 6.7.4/6.8.7/6.9.4 Configuration File unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in Code42 Enterprise and Crashplan for Small Business Client up to 6.7.4/6.8.7/6.9.4. This vulnerability affects unknown code of the component Configuration File Handler. This manipulation causes unrestricted upload. This vulnerability is handled as CVE-2019-11552. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Code42 Enterprise and Crashplan for Small Business Client up to 6.7.4/6.8.7/6.9.4 and classified as critical. Affected by this vulnerability is some unknown processing of the component Configuration File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.

The weakness was released 07/19/2019 (Website). The advisory is shared at support.code42.com. This vulnerability is known as CVE-2019-11552 since 04/25/2019. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 6.7.5, 6.8.8 or 6.9.4 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Code42

Name

• Crashplan for Small Business Client
• Enterprise

Version

• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4
• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.8.7
• 6.9.0
• 6.9.1
• 6.9.2
• 6.9.3
• 6.9.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion