Mutiny Monitoring Appliance Command Injection

2018.08.24

Credit: Reginald Dodd

Risk: High

Local: No

Remote: Yes

CVE: CVE-2018-15529

CWE: CWE-78

CVSS Base Score: 6.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 8/10

Exploit range: Remote

Attack complexity: Low

Authentication: Single time

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

[Title]
Mutiny Monitoring Appliance < 6.1.0-5263 - Command Injection (CVE-2018-15529)

[Product]
Mutiny Monitoring Appliance
https://www.mutiny.com/

[CVE]
CVE-2018-15529

[Credit]
Reginald Dodd

[Description]
A command injection vulnerability in maintenance.cgi in Mutiny "Monitoring Appliance" before 6.1.0-5263 allows authenticated users, with access to the admin interface, to inject arbitrary commands within the filename of a system upgrade upload.

[Version Tested] 
Version 6.1.0-5191 was tested and is vulnerable.

[Solution]
Upgrade to v6.1.0-5263.

[Reference]
https://www.mutiny.com/mutiny-support/previous-releases/ (Under the "Patches/Bugs" Fixed section)

[Timeline]
August 12, 2018 - A detailed report and exploit was sent to the vendor.
August 13, 2018 - The vendor released a patch (version 6.1.0-5263).
August 19, 2018 - Mitre assigned a CVE.

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Mutiny Monitoring Appliance Command Injection

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.