Accellion Secure File Transfer Appliance 'oauth_token' Parameter Remote Command Execution

critical Nessus Plugin ID 85005

Language:

Synopsis

The remote device is affected by a remote command execution vulnerability.

Description

The remote Accellion Secure File Transfer Appliance is affected by a remote command execution vulnerability due to improper sanitization of user-supplied in put to the 'oauth_token' parameter in the get_oauth_customer_name() and verify_oauth_token() functions. The parameter is passed to a system() command through the 'twsgetStatus' handler. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary commands on the remote host.

Note that the twsPut, twssetStatus, twsGet, Find, Put, and mPut handlers are also reportedly affected by this issue; however, Nessus has not tested these additional handlers.

Solution

Upgrade to Accellion Secure File Transfer Appliance version FTA_9_11_210 or later.

Plugin Details

Severity: Critical

ID: 85005

File Name: accellion_fta_oauth_token_rce.nasl

Version: 1.7

Type: remote

Family: CGI abuses

Published: 7/27/2015

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2015-2857

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/h:accellion:secure_file_transfer_appliance

Required KB Items: installed_sw/Accellion Secure File Transfer Appliance

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/25/2015

Vulnerability Publication Date: 7/10/2015

Exploitable With

Metasploit (Accellion FTA getStatus verify_oauth_token Command Execution)

Reference Information

CVE: CVE-2015-2857

Detections

Analytics