BitDefender BOX 2 2.1.47.42 API /api/download_image os command injection

Summaryinfo

A vulnerability classified as critical was found in BitDefender BOX 2 2.1.47.42. The affected element is an unknown function of the file /api/download_image of the component API. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2019-17095. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in BitDefender BOX 2 2.1.47.42. It has been rated as critical. Affected by this issue is an unknown function of the file /api/download_image of the component API. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In order to exploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability.

The weakness was presented 01/27/2020 (Website). The advisory is shared for download at bitdefender.com. This vulnerability is handled as CVE-2019-17095 since 10/02/2019. The exploitation is known to be difficult. The attack needs to be approached locally. The successful exploitation requires a simple authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-149409 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• BitDefender

Name

• BOX 2

Version

• 2.1.47.42

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion