CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2024-9145 (GCVE-0-2024-9145)
Vulnerability from cvelistv5 – Published: 2024-10-01 07:23 – Updated: 2024-11-21 16:56
VLAI
Title
Local command injection in Wiz Code Visual Studio Code extension
Summary
Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wiz | Wiz Code Visual Studio Code extension |
Affected:
1.0.0 , ≤ 1.5.3
(semver)
Affected: 0.13.0 , ≤ 0.17.8 (semver) |
Date Public
2024-10-01 07:21
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9145",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-01T13:46:52.078510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T16:56:55.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Wiz Code Visual Studio Code extension",
"vendor": "Wiz",
"versions": [
{
"lessThanOrEqual": "1.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "0.17.8",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rohit Kumar"
}
],
"datePublic": "2024-10-01T07:21:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgba(232, 232, 232, 0.04);\"\u003eWiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a \"trusted folder\" within Visual Studio Code, and initiates a manual scan of the file.\u003c/span\u003e"
}
],
"value": "Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a \"trusted folder\" within Visual Studio Code, and initiates a manual scan of the file."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T07:49:49.613Z",
"orgId": "9947ef80-c5d5-474a-bbab-97341a59000e",
"shortName": "Wiz"
},
"references": [
{
"url": "https://www.wiz.io/security-advisories"
},
{
"url": "https://marketplace.visualstudio.com/items/WizCloud.wizcli-vscode/changelog"
},
{
"url": "https://marketplace.visualstudio.com/items/WizCloud.wiz-vscode/changelog"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local command injection in Wiz Code Visual Studio Code extension",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9947ef80-c5d5-474a-bbab-97341a59000e",
"assignerShortName": "Wiz",
"cveId": "CVE-2024-9145",
"datePublished": "2024-10-01T07:23:03.891Z",
"dateReserved": "2024-09-24T09:58:45.182Z",
"dateUpdated": "2024-11-21T16:56:55.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9380 (GCVE-0-2024-9380)
Vulnerability from cvelistv5 – Published: 2024-10-08 16:23 – Updated: 2025-10-21 22:55
VLAI
Summary
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
Severity
7.2 (High)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advi… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ivanti | CSA (Cloud Services Appliance) |
Unaffected:
5.0.2
(custom)
|
|
| ivanti | endpoint_manager_cloud_services_appliance |
Affected:
0 , < 5.0.2
(custom)
cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "endpoint_manager_cloud_services_appliance",
"vendor": "ivanti",
"versions": [
{
"lessThan": "5.0.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9380",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T13:49:29.865376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-10-09",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9380"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:55:43.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9380"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-09T00:00:00.000Z",
"value": "CVE-2024-9380 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "CSA (Cloud Services Appliance)",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "5.0.2",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn OS command injection vulnerability in the admin web console of Ivanti CSA\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e before \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eversion 5.0.2\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e allows a \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eremote authenticated\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e attacker \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewith admin privileges \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eobtain remote code execution.\u003c/span\u003e"
}
],
"value": "An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-08T16:23:49.949Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2024-9380",
"datePublished": "2024-10-08T16:23:49.949Z",
"dateReserved": "2024-09-30T21:10:36.364Z",
"dateUpdated": "2025-10-21T22:55:43.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9579 (GCVE-0-2024-9579)
Vulnerability from cvelistv5 – Published: 2024-11-05 16:22 – Updated: 2024-11-05 19:32
VLAI
Title
Certain Poly Video Conference Devices – Potential Remote Code Execution
Summary
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| HP, Inc. | Certain Poly Video Conference Devices |
Affected:
See HP security bulletin reference for affected versions
|
|
| poly | tc8_firmware |
Affected:
0 , < 6.3.2
(custom)
cpe:2.3:o:poly:tc8_firmware:*:*:*:*:*:*:*:* |
|
| poly | tc10_firmware |
Affected:
0 , < 6.3.2
(custom)
cpe:2.3:o:poly:tc10_firmware:*:*:*:*:*:*:*:* |
|
| poly | g7500_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:g7500_firmware:*:*:*:*:*:*:*:* |
|
| poly | studio_x30_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:studio_x30_firmware:*:*:*:*:*:*:*:* |
|
| poly | studio_x50_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:studio_x50_firmware:*:*:*:*:*:*:*:* |
|
| poly | studio_x70_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:studio_x70_firmware:*:*:*:*:*:*:*:* |
|
| poly | studio_x52_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:studio_x52_firmware:*:*:*:*:*:*:*:* |
|
| poly | studio_g62_firmware |
Affected:
0 , < 4.3.2
(custom)
cpe:2.3:o:poly:studio_g62_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:poly:tc8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc8_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:tc10_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tc10_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "6.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:g7500_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "g7500_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x30_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x30_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x50_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x50_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x70_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x70_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_x52_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_x52_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:poly:studio_g62_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "studio_g62_firmware",
"vendor": "poly",
"versions": [
{
"lessThan": "4.3.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-05T19:13:45.885761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T19:32:25.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Certain Poly Video Conference Devices",
"vendor": "HP, Inc.",
"versions": [
{
"status": "affected",
"version": "See HP security bulletin reference for affected versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.\u003c/span\u003e"
}
],
"value": "A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T16:22:01.465Z",
"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"shortName": "hp"
},
"references": [
{
"url": "https://support.hp.com/us-en/document/ish_11536495-11536533-16/hpsbpy03900"
}
],
"source": {
"advisory": "HPSBPY03900",
"discovery": "UNKNOWN"
},
"title": "Certain Poly Video Conference Devices \u2013 Potential Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
"assignerShortName": "hp",
"cveId": "CVE-2024-9579",
"datePublished": "2024-11-05T16:22:01.465Z",
"dateReserved": "2024-10-07T13:24:15.881Z",
"dateUpdated": "2024-11-05T19:32:25.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9773 (GCVE-0-2024-9773)
Vulnerability from cvelistv5 – Published: 2025-03-27 12:31 – Updated: 2025-03-27 13:07
VLAI
Title
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
Summary
An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/498557 | issue-trackingpermissions-required |
| https://hackerone.com/reports/2671808 | technical-descriptionexploitpermissions-required |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-27T13:07:31.748921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T13:07:40.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "GitLab",
"repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
"vendor": "GitLab",
"versions": [
{
"lessThan": "17.8.6",
"status": "affected",
"version": "14.9",
"versionType": "semver"
},
{
"lessThan": "17.9.3",
"status": "affected",
"version": "17.9",
"versionType": "semver"
},
{
"lessThan": "17.10.1",
"status": "affected",
"version": "17.10",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10 before 17.10.1. An input validation issue in the Harbor registry integration could have allowed a maintainer to add malicious code to the CLI commands shown in the UI."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T12:31:27.475Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"name": "GitLab Issue #498557",
"tags": [
"issue-tracking",
"permissions-required"
],
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/498557"
},
{
"name": "HackerOne Bug Bounty Report #2671808",
"tags": [
"technical-description",
"exploit",
"permissions-required"
],
"url": "https://hackerone.com/reports/2671808"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 17.8.6, 17.9.3, 17.10.1 or above."
}
],
"title": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027) in GitLab"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2024-9773",
"datePublished": "2025-03-27T12:31:27.475Z",
"dateReserved": "2024-10-09T21:01:41.384Z",
"dateUpdated": "2025-03-27T13:07:40.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-9793 (GCVE-0-2024-9793)
Vulnerability from cvelistv5 – Published: 2024-10-10 15:31 – Updated: 2024-10-10 17:46
VLAI
Title
Tenda AC1206 ate ate_ifconfig_set command injection
Summary
A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
6.3 (Medium)
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Command Injection
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.279946 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.279946 | signaturepermissions-required |
| https://vuldb.com/?submit.418061 | third-party-advisory |
| https://github.com/ixout/iotVuls/blob/main/Tenda/… | related |
| https://github.com/ixout/iotVuls/blob/main/Tenda/… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | AC1206 |
Affected:
15.03.06.0
Affected: 15.03.06.1 Affected: 15.03.06.2 Affected: 15.03.06.3 Affected: 15.03.06.4 Affected: 15.03.06.5 Affected: 15.03.06.6 Affected: 15.03.06.7 Affected: 15.03.06.8 Affected: 15.03.06.9 Affected: 15.03.06.10 Affected: 15.03.06.11 Affected: 15.03.06.12 Affected: 15.03.06.13 Affected: 15.03.06.14 Affected: 15.03.06.15 Affected: 15.03.06.16 Affected: 15.03.06.17 Affected: 15.03.06.18 Affected: 15.03.06.19 Affected: 15.03.06.20 Affected: 15.03.06.21 Affected: 15.03.06.22 Affected: 15.03.06.23 |
|
| tenda | ac1206_firmware |
Affected:
0 , ≤ 15.03.06.23
(custom)
cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:tenda:ac1206_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ac1206_firmware",
"vendor": "tenda",
"versions": [
{
"lessThanOrEqual": "15.03.06.23",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9793",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-10T16:09:15.570083Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T17:46:05.897Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "AC1206",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "15.03.06.0"
},
{
"status": "affected",
"version": "15.03.06.1"
},
{
"status": "affected",
"version": "15.03.06.2"
},
{
"status": "affected",
"version": "15.03.06.3"
},
{
"status": "affected",
"version": "15.03.06.4"
},
{
"status": "affected",
"version": "15.03.06.5"
},
{
"status": "affected",
"version": "15.03.06.6"
},
{
"status": "affected",
"version": "15.03.06.7"
},
{
"status": "affected",
"version": "15.03.06.8"
},
{
"status": "affected",
"version": "15.03.06.9"
},
{
"status": "affected",
"version": "15.03.06.10"
},
{
"status": "affected",
"version": "15.03.06.11"
},
{
"status": "affected",
"version": "15.03.06.12"
},
{
"status": "affected",
"version": "15.03.06.13"
},
{
"status": "affected",
"version": "15.03.06.14"
},
{
"status": "affected",
"version": "15.03.06.15"
},
{
"status": "affected",
"version": "15.03.06.16"
},
{
"status": "affected",
"version": "15.03.06.17"
},
{
"status": "affected",
"version": "15.03.06.18"
},
{
"status": "affected",
"version": "15.03.06.19"
},
{
"status": "affected",
"version": "15.03.06.20"
},
{
"status": "affected",
"version": "15.03.06.21"
},
{
"status": "affected",
"version": "15.03.06.22"
},
{
"status": "affected",
"version": "15.03.06.23"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ixout (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. This vulnerability affects the function ate_iwpriv_set/ate_ifconfig_set of the file /goform/ate. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In Tenda AC1206 bis 15.03.06.23 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Das betrifft die Funktion ate_iwpriv_set/ate_ifconfig_set der Datei /goform/ate. Durch das Manipulieren mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T15:31:06.625Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-279946 | Tenda AC1206 ate ate_ifconfig_set command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.279946"
},
{
"name": "VDB-279946 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.279946"
},
{
"name": "Submit #418061 | Tenda Router V15.03.06.23 and earlier Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.418061"
},
{
"tags": [
"related"
],
"url": "https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_004/report.md"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ixout/iotVuls/blob/main/Tenda/ac1206_003/report.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-10-10T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-10-10T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-10-10T09:28:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC1206 ate ate_ifconfig_set command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-9793",
"datePublished": "2024-10-10T15:31:06.625Z",
"dateReserved": "2024-10-10T07:23:14.015Z",
"dateUpdated": "2024-10-10T17:46:05.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0328 (GCVE-0-2025-0328)
Vulnerability from cvelistv5 – Published: 2025-01-09 04:31 – Updated: 2025-01-09 16:22
VLAI
Title
KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection
Summary
A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.290792 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.290792 | signaturepermissions-required |
| https://vuldb.com/?submit.470601 | third-party-advisory |
| https://note.zhaoj.in/share/ASPsoVCrLqKK | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| KaiYuanTong | ECT Platform |
Affected:
2.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0328",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T16:13:43.494661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T16:22:00.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://note.zhaoj.in/share/ASPsoVCrLqKK"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTTP POST Request Handler"
],
"product": "ECT Platform",
"vendor": "KaiYuanTong",
"versions": [
{
"status": "affected",
"version": "2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "glzjin (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation of the argument code leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in KaiYuanTong ECT Platform bis 2.0.0 entdeckt. Dies betrifft einen unbekannten Teil der Datei /public/server/runCode.php der Komponente HTTP POST Request Handler. Durch das Manipulieren des Arguments code mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T04:31:06.588Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-290792 | KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.290792"
},
{
"name": "VDB-290792 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.290792"
},
{
"name": "Submit #470601 | KaiYuanTong ECT platform \u003c=2.0.0 Pre-Auth Command Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.470601"
},
{
"tags": [
"exploit"
],
"url": "https://note.zhaoj.in/share/ASPsoVCrLqKK"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-01-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-01-08T15:45:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-0328",
"datePublished": "2025-01-09T04:31:06.588Z",
"dateReserved": "2025-01-08T14:40:17.251Z",
"dateUpdated": "2025-01-09T16:22:00.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0396 (GCVE-0-2025-0396)
Vulnerability from cvelistv5 – Published: 2025-01-12 12:00 – Updated: 2025-01-13 15:18
VLAI
Title
exelban stats XPC Service shouldAcceptNewConnection command injection
Summary
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.291269 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.291269 | signaturepermissions-required |
| https://vuldb.com/?submit.473229 | third-party-advisory |
| https://winslow1984.com/books/cve-collection/page… | related |
| https://github.com/exelban/stats/releases/tag/v2.11.22 | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| exelban | stats |
Affected:
2.11.0
Affected: 2.11.1 Affected: 2.11.2 Affected: 2.11.3 Affected: 2.11.4 Affected: 2.11.5 Affected: 2.11.6 Affected: 2.11.7 Affected: 2.11.8 Affected: 2.11.9 Affected: 2.11.10 Affected: 2.11.11 Affected: 2.11.12 Affected: 2.11.13 Affected: 2.11.14 Affected: 2.11.15 Affected: 2.11.16 Affected: 2.11.17 Affected: 2.11.18 Affected: 2.11.19 Affected: 2.11.20 Affected: 2.11.21 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0396",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T15:17:48.258270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T15:18:12.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"XPC Service"
],
"product": "stats",
"vendor": "exelban",
"versions": [
{
"status": "affected",
"version": "2.11.0"
},
{
"status": "affected",
"version": "2.11.1"
},
{
"status": "affected",
"version": "2.11.2"
},
{
"status": "affected",
"version": "2.11.3"
},
{
"status": "affected",
"version": "2.11.4"
},
{
"status": "affected",
"version": "2.11.5"
},
{
"status": "affected",
"version": "2.11.6"
},
{
"status": "affected",
"version": "2.11.7"
},
{
"status": "affected",
"version": "2.11.8"
},
{
"status": "affected",
"version": "2.11.9"
},
{
"status": "affected",
"version": "2.11.10"
},
{
"status": "affected",
"version": "2.11.11"
},
{
"status": "affected",
"version": "2.11.12"
},
{
"status": "affected",
"version": "2.11.13"
},
{
"status": "affected",
"version": "2.11.14"
},
{
"status": "affected",
"version": "2.11.15"
},
{
"status": "affected",
"version": "2.11.16"
},
{
"status": "affected",
"version": "2.11.17"
},
{
"status": "affected",
"version": "2.11.18"
},
{
"status": "affected",
"version": "2.11.19"
},
{
"status": "affected",
"version": "2.11.20"
},
{
"status": "affected",
"version": "2.11.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "winslow1984 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the attack on the local host. Upgrading to version 2.11.22 is able to address this issue. It is recommended to upgrade the affected component."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in exelban stats bis 2.11.21 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um die Funktion shouldAcceptNewConnection der Komponente XPC Service. Dank der Manipulation mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden muss der Angriff lokal. Ein Aktualisieren auf die Version 2.11.22 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-12T12:00:15.952Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-291269 | exelban stats XPC Service shouldAcceptNewConnection command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.291269"
},
{
"name": "VDB-291269 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.291269"
},
{
"name": "Submit #473229 | https://github.com/exelban Stats \u003c v2.11.22 Local Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.473229"
},
{
"tags": [
"related"
],
"url": "https://winslow1984.com/books/cve-collection/page/stats-v21122-local-privilege-escalation"
},
{
"tags": [
"patch"
],
"url": "https://github.com/exelban/stats/releases/tag/v2.11.22"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-01-11T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-01-11T20:22:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "exelban stats XPC Service shouldAcceptNewConnection command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-0396",
"datePublished": "2025-01-12T12:00:15.952Z",
"dateReserved": "2025-01-11T19:17:10.958Z",
"dateUpdated": "2025-01-13T15:18:12.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0528 (GCVE-0-2025-0528)
Vulnerability from cvelistv5 – Published: 2025-01-17 14:31 – Updated: 2025-01-17 14:48
VLAI
Title
Tenda AC8/AC10/AC18 HTTP Request telnet command injection
Summary
A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.292412 | vdb-entry |
| https://vuldb.com/?ctiid.292412 | signaturepermissions-required |
| https://vuldb.com/?submit.478175 | third-party-advisory |
| https://github.com/Pr0b1em/IoT/blob/master/TendaA… | exploit |
| https://www.tenda.com.cn/ | product |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0528",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-17T14:48:04.184225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-17T14:48:09.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Pr0b1em/IoT/blob/master/TendaAC10v16.03.10.20telnet.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTTP Request Handler"
],
"product": "AC8",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.20"
}
]
},
{
"modules": [
"HTTP Request Handler"
],
"product": "AC10",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.20"
}
]
},
{
"modules": [
"HTTP Request Handler"
],
"product": "AC18",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "16.03.10.20"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Pr0b1em (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality of the file /goform/telnet of the component HTTP Request Handler. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in Tenda AC8, AC10 and AC18 16.03.10.20 entdeckt. Dies betrifft einen unbekannten Teil der Datei /goform/telnet der Komponente HTTP Request Handler. Durch Beeinflussen mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 8.3,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-17T14:31:07.148Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-292412 | Tenda AC8/AC10/AC18 HTTP Request telnet command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.292412"
},
{
"name": "VDB-292412 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.292412"
},
{
"name": "Submit #478175 | Tenda AC10v4.0 v16.03.10.20 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.478175"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Pr0b1em/IoT/blob/master/TendaAC10v16.03.10.20telnet.md"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-01-17T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-01-17T07:54:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda AC8/AC10/AC18 HTTP Request telnet command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-0528",
"datePublished": "2025-01-17T14:31:07.148Z",
"dateReserved": "2025-01-17T06:28:25.730Z",
"dateUpdated": "2025-01-17T14:48:09.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0593 (GCVE-0-2025-0593)
Vulnerability from cvelistv5 – Published: 2025-02-14 20:18 – Updated: 2025-02-14 21:59
VLAI
Title
SICK Lector8xx and InspectorP8xx vulnerable for code execution
Summary
The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://sick.com/psirt | x_SICK PSIRT Website |
| https://cdn.sick.com/media/docs/1/11/411/Special_… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.cisa.gov/resources-tools/resources/ic… | x_ICS-CERT recommended practices on Industrial Security |
| https://www.first.org/cvss/calculator/3.1 | x_CVSS v3.1 Calculator |
| https://www.sick.com/.well-known/csaf/white/2025/… | vendor-advisory |
| https://www.sick.com/.well-known/csaf/white/2025/… | vendor-advisoryx_csaf |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SICK AG | SICK Lector8xx |
Affected:
0 , < 2.4.0
(custom)
|
|
| SICK AG | SICK InspectorP8xx |
Affected:
0 , < 3.11.1
(custom)
|
Date Public
2025-02-14 20:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0593",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T21:39:56.334389Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T21:59:58.197Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SICK Lector8xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SICK InspectorP8xx",
"vendor": "SICK AG",
"versions": [
{
"lessThan": "3.11.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-02-14T20:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device."
}
],
"value": "The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact with the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T20:18:42.184Z",
"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"shortName": "SICK AG"
},
"references": [
{
"tags": [
"x_SICK PSIRT Website"
],
"url": "https://sick.com/psirt"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
},
{
"tags": [
"x_ICS-CERT recommended practices on Industrial Security"
],
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"tags": [
"x_CVSS v3.1 Calculator"
],
"url": "https://www.first.org/cvss/calculator/3.1"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.pdf"
},
{
"tags": [
"vendor-advisory",
"x_csaf"
],
"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0002.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Users are strongly recommended to upgrade to the latest release of the Lector8xx (\u0026gt;=2.4.0)\nand the InspectorP8xx (\u0026gt;=3.11.1) respectively that includes a patch for the vulnerability. It is also\nrecommended to set a secure password, please refer to the respective operating instructions, linked in\nthe reference section."
}
],
"value": "Users are strongly recommended to upgrade to the latest release of the Lector8xx (\u003e=2.4.0)\nand the InspectorP8xx (\u003e=3.11.1) respectively that includes a patch for the vulnerability. It is also\nrecommended to set a secure password, please refer to the respective operating instructions, linked in\nthe reference section."
}
],
"source": {
"advisory": "SCA-2025-0002",
"discovery": "INTERNAL"
},
"title": "SICK Lector8xx and InspectorP8xx vulnerable for code execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988",
"assignerShortName": "SICK AG",
"cveId": "CVE-2025-0593",
"datePublished": "2025-02-14T20:18:42.184Z",
"dateReserved": "2025-01-20T06:40:50.034Z",
"dateUpdated": "2025-02-14T21:59:58.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0798 (GCVE-0-2025-0798)
Vulnerability from cvelistv5 – Published: 2025-01-29 01:31 – Updated: 2025-02-12 19:51
VLAI
Title
MicroWorld eScan Antivirus Quarantine rtscanner os command injection
Summary
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
8.1 (High)
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.293921 | vdb-entry |
| https://vuldb.com/?ctiid.293921 | signaturepermissions-required |
| https://vuldb.com/?submit.484718 | third-party-advisory |
| https://github.com/dmknght/FIS_RnD/blob/main/esca… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MicroWorld | eScan Antivirus |
Affected:
7.0.32
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0798",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T14:55:11.022897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-12T19:51:15.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Quarantine Handler"
],
"product": "eScan Antivirus",
"vendor": "MicroWorld",
"versions": [
{
"status": "affected",
"version": "7.0.32"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FPT IS Security (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been rated as critical. This issue affects some unknown processing of the file rtscanner of the component Quarantine Handler. The manipulation leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in MicroWorld eScan Antivirus 7.0.32 f\u00fcr Linux ausgemacht. Sie wurde als kritisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei rtscanner der Komponente Quarantine Handler. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Die Ausnutzbarkeit gilt als schwierig. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T01:31:03.976Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-293921 | MicroWorld eScan Antivirus Quarantine rtscanner os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.293921"
},
{
"name": "VDB-293921 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.293921"
},
{
"name": "Submit #484718 | Microword Escan Antivirus For Linux 7.0.32 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.484718"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dmknght/FIS_RnD/blob/main/escan_rtscanner_rce.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-01-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-01-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-01-28T15:47:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "MicroWorld eScan Antivirus Quarantine rtscanner os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-0798",
"datePublished": "2025-01-29T01:31:03.976Z",
"dateReserved": "2025-01-28T14:41:58.531Z",
"dateUpdated": "2025-02-12T19:51:15.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Phase: Architecture and Design
Description:
- If at all possible, use library calls rather than external processes to recreate the desired functionality.
Mitigation
Phase: Implementation
Description:
- If possible, ensure that all external commands called from the program are statically created.
Mitigation ID: MIT-5
Phase: Implementation
Strategy: Input Validation
Description:
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation
Phase: Operation
Description:
- Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
Mitigation
Phase: System Configuration
Description:
- Assign permissions that prevent the user from accessing/opening privileged files.
CAPEC-136: LDAP Injection
An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-183: IMAP/SMTP Command Injection
An adversary exploits weaknesses in input validation on web-mail servers to execute commands on the IMAP/SMTP server. Web-mail servers often sit between the Internet and the IMAP or SMTP mail server. User requests are received by the web-mail servers which then query the back-end mail server for the requested information and return this response to the user. In an IMAP/SMTP command injection attack, mail-server commands are embedded in parts of the request sent to the web-mail server. If the web-mail server fails to adequately sanitize these requests, these commands are then sent to the back-end mail server when it is queried by the web-mail server, where the commands are then executed. This attack can be especially dangerous since administrators may assume that the back-end server is protected against direct Internet access and therefore may not secure it adequately against the execution of malicious commands.
CAPEC-248: Command Injection
An adversary looking to execute a command of their choosing, injects new items into an existing command thus modifying interpretation away from what was intended. Commands in this context are often standalone strings that are interpreted by a downstream component and cause specific responses. This type of attack is possible when untrusted values are used to build these command strings. Weaknesses in input validation or command construction can enable the attack and lead to successful exploitation.
CAPEC-40: Manipulating Writeable Terminal Devices
This attack exploits terminal devices that allow themselves to be written to by other users. The attacker sends command strings to the target terminal device hoping that the target user will hit enter and thereby execute the malicious command with their privileges. The attacker can send the results (such as copying /etc/passwd) to a known directory and collect once the attack has succeeded.
CAPEC-43: Exploiting Multiple Input Interpretation Layers
An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
CAPEC-75: Manipulating Writeable Configuration Files
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.