Nokia BMC Log Scanner Remote Code Execution

vendor:

BMC Log Scanner

by:

Carlos Andres Gonzalez, Matthew Gregory

6.1

CVSS

HIGH

Remote Code Execution

CWE

Product Name: BMC Log Scanner

Affected Version From: Up to version 13

Affected Version To: Version 13

Patch Exists: YES

Related CWE: CVE-2022-45899

CPE: a:nokia:bmc_log_scanner:13

Metasploit:

Other Scripts:

Platforms Tested: Linux

2023

Nokia BMC Log Scanner Remote Code Execution

The BMC Log Scanner web application in Nokia's BMC is vulnerable to command injection attacks, which can be exploited for unauthenticated remote code execution. This vulnerability is critical as the service runs with root privileges. By injecting a malicious command in the Search Pattern field, an attacker can execute arbitrary commands on the target system as root.

Mitigation:

Upgrade to version 13.1 or later to mitigate this remote code execution vulnerability in Nokia BMC Log Scanner. Additionally, restrict network access to the BMC interface to trusted sources only.

Source

Exploit-DB raw data:

# Exploit Title: Nokia BMC Log Scanner Remote Code Execution
# Google Dork: N/A
# Date: November 29, 2023
# Exploit Author: Carlos Andres Gonzalez, Matthew Gregory
# Vendor Homepage: https://www.nokia.com/
# Software Link: N/A
# Version: 13
# Tested on: Linux
# CVE : CVE-2022-45899

Description
The BMC Log Scanner web application, available on several hosts, is vulnerable to command injection
attacks, allowing for unauthenticated remote code execution. This vulnerability is especially significant
because this service runs as root.

Steps to Reproduce:
In the Search Pattern field, type:

;";command

Replacing the word "command" above with any Linux command.
Root access can be confirmed with the id command or any other command that would require
root access, such as displaying the contents of the /etc/shadow file."

This issue was fixed in version 13.1.