Rhino Security Labs

Unitrends Enterprise Backup Remote Code Execution in systems.php File
[CVE-2017-7280]

Vulnerability Details

CVSS Rating: 9.8 (critical)

CVE-2017-7280

Disclosing Company: Rhino Security Labs

Date: 04/12/2017

Status: Published

Affected software/version:
Unitrends Enterprise Backup < 9.0.0

Disclosure

Rhino Security Labs References

Blog Post: "Unitrends Vulnerability Hunting: Remote Code Execution

GitHub: Code Execution via Password Change

Unitrends: "Unitrends RCE in systems.php Password"

MITRE

NIST

Disclosure Date

04/12/2017

Vulnerability Description

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.

Related Disclosures

Unitrends Enterprise Backup Remote Code Execution in reports.php File
[CVE-2017-7281]

Unitrends Enterprise Backup Remote Code Execution in restore.php File
[CVE-2017-7283]

Unitrends Enterprise Backup Privilege Escalation in users.php File
[CVE-2017-7284]

Unitrends Enterprise Backup Privilege Escalation in Token Cookie
[CVE-2017-7279]

Unitrends Enterprise Backup Local File Inclusion
[CVE-2017-7282]

CVSS Metrics

CVSS Rating (version 3.0)

9.8 (Critical)

Impact Score

Exploitability Score

5.9

3.9

Attack Vector

Network

Attack Complexity (AC)Low Privileges Required (PR)None User Interaction (UI)None Scope (S)Unchanged

Confidentiality (C)High Integrity (I)High Availability (A)High