Executive brief
GenieACS, a platform used to manage and configure telecommunications equipment, contains a critical security flaw in its user interface. An unauthorized attacker can remotely execute malicious commands on the server by sending a specially crafted request to the network diagnostic (ping) tool. This could lead to a complete takeover of the management server, potentially allowing attackers to disrupt internet services or access sensitive device configurations.
Technical details
An OS command injection vulnerability exists in GenieACS 1.2.x prior to 1.2.8 within the UI interface API. The flaw is located in the 'ping' functionality (specifically lib/ui/api.ts and lib/ping.ts), where the 'host' argument is passed to a system shell via the 'child_process.exec' function without adequate input validation or authorization checks. A remote, unauthenticated attacker can exploit this by injecting shell metacharacters into the host parameter to execute arbitrary commands with the privileges of the GenieACS process. The issue is resolved in version 1.2.8 by implementing a strict validation function (isValidHost) for the host argument.
Affected products
- GenieACS GenieACS 1.2.x before 1.2.8
Timeline
- 2021-10-27: patched: Version 1.2.8 released
- 2022-03-06: advisory: NVD published CVE-2021-46704
- 2022-03-07: disclosed: GitHub Advisory published