CVE-2017-9812

published 2017-07-17

CVE-2017-9812: The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance…

Priority P2 60 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kaspersky	anti-virus_for_linux_server	<= 8.0.3.297	—

Detection & IOCs extracted from sources · hover to see the quote

url /cgi-bin/cgictl?action=getReportStatus&reportId=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00↗

url /cgi-bin/cgictl?action=setTaskSettings↗

url /cgi-bin/cgictl?action=licenseKeyInfo&do_action=licenseKeyInfo&scriptName=&active=&licenseKey=bla↗

path /opt/kaspersky/kav4fs/bin/kav4fs-control↗

port 9080↗

• → Detect path traversal attempts against the getReportStatus endpoint by monitoring for URL-encoded dot-dot-slash sequences (..%2f) in the reportId parameter, especially with a null byte (%00) terminator. ↗
• → Alert on HTTP GET requests to /cgi-bin/cgictl with action=getReportStatus containing %2f and %00 in the reportId query parameter value. ↗
• → Monitor for unauthenticated or cross-origin POST requests to /cgi-bin/cgictl?action=setTaskSettings, which can be used via CSRF to inject arbitrary shell commands into the notifier Actions Command field. ↗
• → Monitor for creation of unexpected files under /etc/cron.d/ (e.g., /etc/cron.d/implant) by the kluser account or via kav4fs-control quarantine restore operations, which indicates privilege escalation abuse. ↗
• → Detect execution of kav4fs-control with -Q --restore flags combined with a --file path outside of the expected quarantine restore directory, particularly targeting /etc/cron.d/. ↗
• → Alert on outbound TCP connections from the Kaspersky AV server process or kluser-owned processes to unexpected external IPs on non-standard ports (e.g., port 8000), indicative of reverse shell activity. ↗
• → Monitor web management console (port 9080) for requests to /cgi-bin/cgictl with action=licenseKeyInfo and a scriptName parameter containing script tags or other XSS payloads. ↗

• · The path traversal PoC uses a null byte (%00) to terminate the reportId string; some WAF/IDS URL normalization may strip null bytes before inspection, potentially causing the attack to evade detection. ↗
• · The CSRF-based RCE (CVE-2017-9810) requires an authenticated admin session to be active; the attack window depends on the victim browsing an attacker-controlled page while authenticated to the console. ↗
• · The privilege escalation (CVE-2017-9811) requires prior code execution as kluser; it is a post-exploitation step and not directly remotely exploitable on its own. ↗
• · The advisory notes that other products and versions beyond 8.0.3.297 might be affected but were not tested; detections should not be scoped exclusively to that version. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200