nvd-json-data-feeds/CVE-2017/CVE-2017-93xx/CVE-2017-9388.json

{
  "id": "CVE-2017-9388",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-06-17T17:15:10.537",
  "lastModified": "2019-06-20T14:51:06.173",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface that allows a user to manage the device. As a part of the functionality the device firmware file contains a file known as proxy.sh which allows the device to proxy a specific request to and from from another website. This is primarily used as a method of communication between the device and Vera website when the user is logged in to the https://home.getvera.com and allows the device to communicate between the device and website. One of the parameters retrieved by this specific script is \"url\". This parameter is not sanitized by the script correctly and is passed in a call to \"eval\" to execute \"curl\" functionality. This allows an attacker to escape from the executed command and then execute any commands of his/her choice."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 un problema en los dispositivos Vera VeraEdge 1.7.19 y Veralite 1.7.481. El dispositivo proporciona una interfaz de usuario web que permite a un usuario administrar el dispositivo. Como parte de la funcionalidad, el archivo de firmware del dispositivo contiene un archivo conocido como proxy.sh que le permite al dispositivo enviar una solicitud espec\u00edfica hacia y desde otro sitio web. Esto se usa principalmente como un m\u00e9todo de comunicaci\u00f3n entre el dispositivo y el sitio web de Vera cuando el usuario ha iniciado sesi\u00f3n en https://home.getvera.com y permite que el dispositivo se comunique entre el dispositivo y el sitio web. Uno de los par\u00e1metros recuperados por este script espec\u00edfico es \"url\". Este par\u00e1metro no est\u00e1 correctamente saneado por el script y se pasa en una llamada a \"eval\" para ejecutar la funcionalidad \"curl\". Esto permite a un atacante escapar del comando ejecutado y luego ejecutar cualquier comando de su elecci\u00f3n."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getvera:veraedge_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.7.19",
              "matchCriteriaId": "49C1D79D-A586-4D41-A10C-1815E6E0D765"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getvera:veraedge:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A3D3CAC-84A4-4F14-8FB6-1E6437F8D2C0"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:getvera:veralite_firmware:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.7.481",
              "matchCriteriaId": "AC96E7A8-DB6C-47C8-9B33-AE4ED418C70E"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:getvera:veralite:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "914728A7-7BA3-4612-A6AA-172B24431947"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/153242/Veralite-Veraedge-Router-XSS-Command-Injection-CSRF-Traversal.html",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Vera_sec_issues.pdf",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Jun/8",
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}