CVE-2021-42855: Aternity SteelCentral AppInternals Dynamic Sampling

Описание

Оригинално описание

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.

Засегнати продукти

• Aternity SteelCentral AppInternals Dynamic Sampling Agent: 10.x; 12.13.0 преди 12.13.0; 11.8.8 преди 11.8.8

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в Aternity SteelCentral AppInternals Dynamic Sampling Agent

• 9.8CVE-2021-42854
• 4.7CVE-2021-42856
• 9.4CVE-2021-42787
• 5.3CVE-2021-42857
• 9.8CVE-2021-42786

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-42855
• https://nvd.nist.gov/vuln/detail/CVE-2021-42855
• https://aternity.force.com/customersuccess/s/article/Local-privilege-escalation-due-to-misconfigured-write-permission-on-debug-command-config-file-CVE-2021-42855