FKIE_CVE-2020-35710

Vulnerability from fkie_nvd - Published: 2020-12-25 19:15 - Updated: 2024-11-21 05:27
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.
References
cve@mitre.orghttps://twitter.com/amadapa/status/1342407005110218753Third Party Advisory
cve@mitre.orghttps://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.htmlExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/amadapa/status/1342407005110218753Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.htmlExploit, Third Party Advisory
Impacted products
Vendor Product Version
parallels remote_application_server 18.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parallels:remote_application_server:18.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B246B73-F911-4579-A091-D92584323B04",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker\u0027s client for use as a \"host\" value. In other words, after an attacker\u0027s web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like \"host\":\"192.168.###.###\" in the POST data."
    },
    {
      "lang": "es",
      "value": "Parallels Remote Application Server (RAS) versi\u00f3n 18, permite a atacantes remotos detectar una direcci\u00f3n IP de intranet porque el env\u00edo del formulario de inicio de sesi\u00f3n (inclusive con credenciales en blanco) proporciona esta direcci\u00f3n al cliente del atacante para usarla como valor de \"host\".\u0026#xa0;En otras palabras, despu\u00e9s de que el navegador web de un atacante envi\u00f3 una petici\u00f3n hacia el formulario de inicio de sesi\u00f3n, podr\u00eda autom\u00e1ticamente enviar una segunda petici\u00f3n hacia un URI RASHTML5Gateway/socket.io con algo como \"host\":\"192.168.###.###\" en los datos POST"
    }
  ],
  "id": "CVE-2020-35710",
  "lastModified": "2024-11-21T05:27:53.670",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-12-25T19:15:13.177",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/amadapa/status/1342407005110218753"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/amadapa/status/1342407005110218753"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.