CVE-2018-7567

OTRS Command Injection

Severity Score

7.2

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1, authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating "the behaviour is as designed and needed for different packages to be installed", "there is a security warning if the package is not verified by OTRS Group", and "there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.

** EN DISPUTA ** En el Admin Package Manager en Open Ticket Request System (OTRS) 5.0.0 hasta 5.0.24 y 6.0.0 hasta 6.0.1, los administradores autenticados pueden explotar una vulnerabilidad de ejecución remota de código ciega cargando un archivo opm manipulado mediante un elemento CodeInstall para ejecutar un comando en el servidor mediante la instalación de paquetes. NOTA: el fabricante discute este problema argumentando que "el comportamiento se ha diseñado así y es necesario para que diferentes paquetes sean instalados", "hay una advertencia de seguridad si el paquete no está verificado por OTRS Group" y "es posible y la responsabilidad de un administrador comprobar los paquetes antes de instalarlos, lo que es posible porque no son binarios".

OTRS versions 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1 suffer from remote code execution vulnerabilities.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-02-28 CVE Reserved
2018-03-03 CVE Published
2024-08-05 CVE Updated
2024-08-05 First Exploit
2024-10-05 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-434: Unrestricted Upload of File with Dangerous Type

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://0day.today/exploit/29938	2024-08-05

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Otrs Search vendor "Otrs"		Otrs Search vendor "Otrs" for product "Otrs"				>= 5.0.0 <= 5.0.23 Search vendor "Otrs" for product "Otrs" and version " >= 5.0.0 <= 5.0.23"		-		Affected
Otrs Search vendor "Otrs"		Otrs Search vendor "Otrs" for product "Otrs"				6.0.0 Search vendor "Otrs" for product "Otrs" and version "6.0.0"		-		Affected
Otrs Search vendor "Otrs"		Otrs Search vendor "Otrs" for product "Otrs"				6.0.1 Search vendor "Otrs" for product "Otrs" and version "6.0.1"		-		Affected