CVE-2018-14649 — Command Injection in Redhat Ceph Storage

CWE-77 — Command Injection5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
58.1%
top 1.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Redhat Ceph StorageRedhat Enterprise Linux DesktopRedhat Enterprise Linux Server+1 more
Timeline
PublishedOct 9
Latest updateMay 13

Description

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of us…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶NVDredhat/ceph_storage2.0, 3.0+1

Patches

Patch: access.redhat.com ↗Patch: github.com ↗Patch: access.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-vq9p-965j-5xf8: It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode↗2022-05-13
▶
CVEList
CVE-2018-14649: It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode↗2018-10-09
▶

📋Vendor Advisories

1
Red Hat
ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution↗2018-09-24
▶

💬Community

1
Bugzilla
CVE-2018-14649 ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution↗2018-09-24
▶