CVE-2020-7351 : An OS Command Injection vulnerability in the endpoint

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

Published 2020-05-01 16:15:13

Updated 2022-04-18 09:37:06

Source Rapid7, Inc.

View at NVD, CVE.org

Products affected by CVE-2020-7351

Netfortris » Trixbox » Community Edition
Versions from including (>=) 1.2.0 and up to, including, (<=) 2.8.0.4
cpe:2.3:a:netfortris:trixbox:*:*:*:*:community:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-7351

EPSS FAQ

92.90%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-7351

TrixBox CE endpoint_devicemap.php Authenticated Command Execution

Disclosure Date: 2020-04-28

First seen: 2020-05-14

exploit/unix/webapp/trixbox_ce_endpoint_devicemap_rce

This module exploits an authenticated OS command injection vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4 inclusive in the "network" POST parameter of the "/maint/modules/endpointcfg/endpoint_devicemap.php" page. Successful exploitation

More information

CVSS scores for CVE-2020-7351

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	2.1	5.2	cve@rapid7.con
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-7351

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Assigned by:
- cve@rapid7.con (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2020-7351

https://github.com/rapid7/metasploit-framework/pull/13353

Trixbox CE v2.8.0.4 endpoint_devicemap.php Authenticated Remote Command Execution by stasinopoulos · Pull Request #13353 · rapid7/metasploit-framework · GitHub
Exploit;Issue Tracking;Patch;Third Party Advisory
http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html

TrixBox CE 2.8.0.4 Command Execution ≈ Packet Storm
Exploit;Third Party Advisory

Jump to