OS Command Injection

2023-11-0607:28:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

command injection

vulnerable

exploit

subrion

webshell

sanitization

server

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

41.1%

JSON

intelliants/subrion is vulnerable to OS Command Injection. The vulnerability is due to a lack of sanitization in the hooks system module. An attacker is able to exploit this vulnerability by sending a specially crafted webshell to a vulnerable Subrion installation. The request would contain a specially crafted command that would be executed on the server. The attacker could then use this command to perform unintended actions on the server.