CVE-2017-6320

published 2017-07-18

CVE-2017-6320: A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19)…

Priority P2 67 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
barracuda	load_balancer_adc	<= 6.0.1.006	—

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-mod/index.cgi↗

port 8000↗

path /home/product/code/firmware/current/bin/rdpd↗

command sudo /bin/cp /bin/sh {sudo_cmd_exec} ; sudo /bin/chmod +x {sudo_cmd_exec}↗

command printf "${encoded_elf}" > /tmp/m; chmod +rx /tmp/m ; /tmp/m↗

command sudo /bin/rm -f /tmp/n ;printf "${encoded_cmd}" > /tmp/n; chmod +rx /tmp/n ; /tmp/n↗

• → Monitor POST requests to /cgi-mod/index.cgi containing both 'delete_assessment' and 'UPDATE_scan_information_in_use' parameters, especially where UPDATE_scan_information_in_use value contains shell metacharacters (e.g., semicolons, pipe characters). ↗
• → Detect multipart/form-data POST requests to /cgi-mod/index.cgi on port 8000 with the X-Requested-With: XMLHttpRequest header, which is used during the authentication phase of the exploit. ↗
• → Alert on creation or execution of short random-named files under /tmp/ (4–8 alphanumeric characters) on Barracuda Load Balancer systems, as the exploit drops base64-decoded payloads there. ↗
• → Detect the exploit's privilege escalation pattern: 'sudo /bin/cp /bin/sh' overwriting a legitimate binary path under /home/product/code/firmware/current/bin/. ↗
• → The vulnerability is triggered via the delete_assessment command with unsanitized data in the UPDATE_scan_information_in_use field processed in a system call; flag any shell injection characters in that parameter. ↗

• · The exploit requires authentication (valid credentials); default credentials 'admin'/'admin' are hardcoded in the PoC, meaning the attack surface is limited to authenticated users or devices with default credentials left unchanged. ↗
• · Affected versions are confirmed as v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); the vulnerability is fixed in version 6.1.0.003 (2017-01-17). Detection rules should be scoped to unpatched devices. ↗
• · The exploit targets the Linux x86 architecture specifically; the Metasploit module generates a Linux x86 ELF payload, so detections for dropped ELF binaries in /tmp/ should be tuned accordingly. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78