Vulnerability Details : CVE-2018-11138
Public exploit exists!
Used for ransomware!
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVE-2018-11138 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Quest KACE System Management Appliance Remote Command Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2018-11138
Added on
2022-03-25
Action due date
2022-04-15
Exploit prediction scoring system (EPSS) score for CVE-2018-11138
92.28%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2018-11138
-
Quest KACE Systems Management Command Injection
Disclosure Date: 2018-05-31First seen: 2020-04-26exploit/unix/http/quest_kace_systems_management_rceThis module exploits a command injection vulnerability in Quest KACE Systems Management Appliance version 8.0.318 (and possibly prior). The `download_agent_installer.php` file allows unauthenticated users to execute arbitrary commands as the web server user `www`.
CVSS scores for CVE-2018-11138
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-11138
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-11138
-
https://www.exploit-db.com/exploits/44950/
Quest KACE Systems Management - Command Injection (Metasploit)Exploit;Third Party Advisory;VDB Entry
-
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
Quest KACE System Management Appliance Multiple Vulnerabilities | Core SecurityExploit;Technical Description;Third Party Advisory
Products affected by CVE-2018-11138
- cpe:2.3:a:quest:kace_system_management_appliance:8.0.318:*:*:*:*:*:*:*