Code injection exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. In the agent interface, an authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.

OTRS reports :

An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user.

An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal article information of their customer tickets.

An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.

An attacker can send a specially prepared email to an OTRS system. If this system has cookie support disabled, and a logged in agent clicks a link in this email, the session information could be leaked to external systems, allowing the attacker to take over the agent's session.

Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents.

For Debian 7 'Wheezy', these problems have been fixed in version 3.3.18-1~deb7u2.

We recommend that you upgrade your otrs2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of OTRS running on the remote host is 3.3.x prior to 3.3.20, 4.0.x prior to 4.0.26, or 5.0.x prior to 5.0.24. It is, therefore, affected by a remote code execution vulnerability.

This update for otrs fixes the following security issues :

  - CVE-2017-15864: Remote authenticated attackers could     have caused otrs to disclose configuration information,     including database credentials (boo#1068677,     OSA-2017-06)

  - CVE-2017-16664: Remote authenticated attackers could     have caused the execution of shell commands with the     permission of the web server user (boo#1069391,     OSA-2017-07)

Two vulnerabilities were discovered in the Open Ticket Request System which could result in disclosure of database credentials or the execution of arbitrary shell commands by logged-in agents.

ID	Name	Product	Family	Severity
105503	FreeBSD : OTRS -- Multiple vulnerabilities (cebd05d6-ed7b-11e7-95f2-005056925db4)	Nessus	FreeBSD Local Security Checks	high
105378	Debian DLA-1212-1 : otrs2 security update	Nessus	Debian Local Security Checks	high
105156	OTRS Authenticated Remote Code Execution (OSA-2017-07)	Nessus	CGI abuses	high
104763	openSUSE Security Update : otrs (openSUSE-2017-1291)	Nessus	SuSE Local Security Checks	high
104753	Debian DSA-4047-1 : otrs2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16664

high

Tenable Plugins

high

high

high

high

high