vendor:
SecureSphere
by:
rsp3ar
8.8
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: SecureSphere
Affected Version From: 13.0.10
Affected Version To: 13.2.10
Patch Exists: NO
Related CWE: N/A
CPE: a:imperva:securesphere
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: SecureSphere (Virtual Appliance)
2018
Imperva SecureSphere 13 – Remote Command Execution
PWS is a component in SecureSphere v13, which consists of Python CGIs to expose various cli utilities over https. The Python CGIs didn't properly sanitize user supplied command parameters, leading to command injection. The vulnerability could be exploited in two ways: Unauthenticated Remote Code Execution (Pre-FTL mode) and Authenticated Remote Code Execution (Gateway mode).
Mitigation:
SecureSphere should be configured into SOM/MX/Gateway mode via 'ftl' utility and user supplied command parameters should be properly sanitized.