Vulnerability CVE-2017-18001
Published: 2017-12-31

Description:
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.

Type:

CWE-306

 (Missing Authentication for Critical Function)

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Trustwave -> Secure web gateway 

 References:
http://seclists.org/fulldisclosure/2017/Dec/88
https://blogs.securiteam.com/index.php/archives/3550
https://www.exploit-db.com/exploits/44047/
https://www.trustwave.com/Resources/Trustwave-Software-Updates/Important-Security-Update-for-Trustwave-Secure-Web-Gateway/
Copyright 2024, cxsecurity.com

 

Back to Top