CVE-2018-5347

published 2018-01-12

CVE-2018-5347: Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs…

Priority P2 79 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.

Detection & IOCs extracted from sources · hover to see the quote

path /etc/lighttpd/conf.d/django-host.conf↗

path /usr/lib/django_host/seagate_media_server/urls.py↗

path /usr/lib/django_host/seagate_media_server/views.py↗

path /usr/local/bin/log_telemetry↗

path /usr/bin/log-extract-manager.sh↗

url http://personalcloud.local:80/uploadTelemetry.psp?TimeStamp=%3b↗

url http://personalcloud.local:80/getLogs.psp?time_stamp=%3b↗

command ngc --start sshd 2>&1↗

• → Monitor HTTP requests to .psp endpoints on the Seagate Personal Cloud device, specifically GET requests to uploadTelemetry.psp and getLogs.psp containing shell metacharacters (e.g., %3b / semicolons) in the TimeStamp, time_stamp, or arch_id parameters. ↗
• → Alert on GET parameters TimeStamp (uploadTelemetry.psp) and time_stamp/arch_id (getLogs.psp) containing shell metacharacters such as semicolons, pipes, or backticks, as these are passed unsanitized to commands.getoutput() / commands.getstatusoutput(). ↗
• → Both vulnerable views use the @csrf_exempt decorator, meaning exploitation can also be triggered via CSRF from a malicious web page — monitor for cross-origin requests to these .psp endpoints. ↗
• → Detect unexpected execution of sshd enablement commands (ngc --start sshd) or passwd changes originating from the lighttpd/FastCGI process, which would indicate successful exploitation. ↗
• → Any URL ending in .psp is routed via FastCGI to the Django Media Server; monitor the FastCGI socket /var/run/manage_py-fastcgi.socket for unexpected or high-frequency connections. ↗

• · The FastCGI routing rule in lighttpd is configured to forward ALL .psp and .psp/ URLs to the Django Media Server without local file checks, meaning no filesystem-level gatekeeping exists for these endpoints. ↗
• · Injected commands execute with root privileges, making exploitation immediately critical with no privilege escalation step required. ↗
• · No authentication is required to reach the vulnerable uploadTelemetry and getLogs endpoints; exploitation is fully unauthenticated. ↗
• · Seagate refused to provide a fix timeline or coordinate disclosure, so no official patch status was confirmed at time of advisory publication. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78