CVE-2021-45967
published 2022-03-18CVE-2021-45967: An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
20.80%
97.2th percentile
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| igniterealtime | openfire | < 4.5.0 | 4.5.0 |
| igniterealtime | openfire | — | — |
| pascom | cloud_phone_system | <= 7.19 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect path traversal attempts against Pascom CPS Tomcat backend via NGINX using the '..;/' bypass sequence targeting the /services/pluginscript/ endpoint ↗
- →Confirm SSRF exploitation by checking for an outbound HTTP interaction triggered from the server (interactsh/OOB callback) in response to the crafted request ↗
- →A successful exploit returns HTTP 200 status alongside the OOB HTTP callback, both conditions must be met ↗
- ·The vulnerability arises from a configuration error between NGINX and a backend Tomcat server; the '..;/' sequence is a known Tomcat path traversal bypass that NGINX fails to normalise before proxying, exposing unintended Tomcat endpoints ↗
- ·Affected versions are Pascom Cloud Phone System before 7.20.x; the nuclei template targets all versions matching cpe:2.3:a:pascom:cloud_phone_system:* ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6669-q2h5-85q9: An issue was discovered in Pascom Cloud Phone System before 7
ghsa_unreviewed·2022-03-19
CVE-2021-45967 [CRITICAL] CWE-22 GHSA-6669-q2h5-85q9: An issue was discovered in Pascom Cloud Phone System before 7
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
VulnCheck
pascom cloud_phone_system Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2021·CVSS 9.8
CVE-2021-45967 [CRITICAL] pascom cloud_phone_system Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
pascom cloud_phone_system Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
An issue was discovered in Pascom Cloud Phone System before 7.20.x. A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints.
Affected: pascom cloud_phone_system
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-45967; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2021-4596
No detection rules found.
Nuclei
Pascom CPS Server-Side Request Forgery
nuclei·CVSS 9.8
CVE-2021-45967 [CRITICAL] Pascom CPS Server-Side Request Forgery
Pascom CPS Server-Side Request Forgery
Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.
Template:
id: CVE-2021-45967
info:
name: Pascom CPS Server-Side Request Forgery
author: dwisiswant0
severity: critical
description: Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.
impact: |
The vulnerability can result in unauthorized access to sensitive data or systems, potentially leading to further exploitation or compromise.
remediation: |
Apply the latest security patches or updates provided by Pascom to fix the Server-Side Request Forgery vulnerability (CVE-2021-45967).
reference:
- https://kerbit.io/research/read/blog/4
- https://www.pascom.net/doc/en/
https://kerbit.io/research/read/blog/4https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.htmlhttps://www.pascom.net/doc/en/release-notes/https://www.pascom.net/doc/en/release-notes/pascom19/https://kerbit.io/research/read/blog/4https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.htmlhttps://www.pascom.net/doc/en/release-notes/https://www.pascom.net/doc/en/release-notes/pascom19/
2022-03-18
Published
Exploited in the wild