Code injection

2019-07-0219:15:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.7%

JSON

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl “engine”) on invocation. If that curl is invoked by a privileged user it can do anything it wants.

CPENameOperatorVersion
curlle7.65.1
oncommand_unified_managerge7.3
oncommand_unified_managerge9.5
enterprise_manager_ops_centereq12.3.3
enterprise_manager_ops_centereq12.4.0
http_servereq12.2.1.3.0
http_servereq12.2.1.4.0
mysql_serverge8.0.0
mysql_serverle8.0.17
mysql_serverge5.0.0

Name	Operator	Version
curl	le	7.65.1
oncommand_unified_manager	ge	7.3
oncommand_unified_manager	ge	9.5
enterprise_manager_ops_center	eq	12.3.3
enterprise_manager_ops_center	eq	12.4.0
http_server	eq	12.2.1.3.0
http_server	eq	12.2.1.4.0
mysql_server	ge	8.0.0
mysql_server	le	8.0.17
mysql_server	ge	5.0.0