Vulnerability Details : CVE-2021-32647
Potential exploit
Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `<constructor>(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.
Vulnerability category: Execute code
Products affected by CVE-2021-32647
- cpe:2.3:a:nsa:emissary:6.4.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-32647
3.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-32647
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
2.3
|
6.0
|
NIST | |
|
8.0
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
1.3
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2021-32647
-
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.Assigned by: security-advisories@github.com (Secondary)
-
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-32647
-
https://github.com/NationalSecurityAgency/emissary/security/advisories/GHSA-ph73-7v9r-wg32
Post-authentication Remote Code Execution (RCE) in emissary:emissary · Advisory · NationalSecurityAgency/emissary · GitHubPatch;Third Party Advisory
-
https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36
emissary/CreatePlaceAction.java at 30c54ef16c6eb6ed09604a929939fb9f66868382 · NationalSecurityAgency/emissary · GitHubExploit;Third Party Advisory
Jump to