CVE-2017-6398 Command injection in n/a

High 8.8 Published 14 Mar 2017 Updated 5 Aug 2024

Authenticated attackers can execute arbitrary OS commands as root via improper input sanitization in the saveCert endpoint of Trend Micro IMSVA.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-6398?

CVE-2017-6398 is a high-severity command injection vulnerability in n/a, published on 14 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.

Weakness: CWE-78

Which versions are affected by CVE-2017-6398?

It affects 1 product.

Products include Trendmicro Interscan Messaging Security Virtual Appliance.

How do I fix CVE-2017-6398?

No fix has been published for CVE-2017-6398 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-6398 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-6398 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-w5hc-4jjm-xx8x.