CVE-2021-46704 OS Command Injection in GenieACS
Unauthenticated attackers can execute arbitrary OS commands via the ping host argument in the GenieACS UI API due to insufficient input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46704?
CVE-2021-46704 is a critical command injection vulnerability in n/a, published on 6 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Weakness: CWE-78
Which versions are affected by CVE-2021-46704?
2 open source packages ship an affected version, including genieacs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
genieacs npm | All versions | 1.2.8 |
genieacs npm | All versions | 1.2.8 |
Products include Genieacs Genieacs.
How do I fix CVE-2021-46704?
Upgrade genieacs to 1.2.8 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-46704 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-46704 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2877-693q-pj33.