In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.

The version of OTRS running on the remote host is 4.0.x prior to 4.0.27, 5.0.x prior to 5.0.25, or 6.0.x prior to 6.0.2. It is, therefore, affected by a remote code execution vulnerability due to improper validation of user-supplied data. An authenticated, remote attacker can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.

OTRS reports :

An attacker who is logged into OTRS as an agent can request special URLs from OTRS which can lead to the execution of shell commands with the permissions of the web server user.

An attacker who is logged into OTRS as a customer can use the ticket search form to disclose internal article information of their customer tickets.

An attacker who is logged into OTRS as an agent can manipulate form parameters and execute arbitrary shell commands with the permissions of the OTRS or web server user.

An attacker can send a specially prepared email to an OTRS system. If this system has cookie support disabled, and a logged in agent clicks a link in this email, the session information could be leaked to external systems, allowing the attacker to take over the agent's session.

Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents.

For Debian 7 'Wheezy', these problems have been fixed in version 3.3.18-1~deb7u2.

We recommend that you upgrade your otrs2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents.

ID	Name	Product	Family	Severity
122156	OTRS Authenticated Remote Code Execution (OSA-2017-09)	Nessus	CGI abuses	high
105503	FreeBSD : OTRS -- Multiple vulnerabilities (cebd05d6-ed7b-11e7-95f2-005056925db4)	Nessus	FreeBSD Local Security Checks	high
105378	Debian DLA-1212-1 : otrs2 security update	Nessus	Debian Local Security Checks	high
105330	Debian DSA-4066-1 : otrs2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16921

high

Tenable Plugins

high

high

high

high