Quest KACE System Management Appliance 8.0.318 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

criticalseverity

9.8CVSS score

91.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

Impact

An attacker can execute arbitrary commands on the affected system, potentially leading to complete system compromise, data theft, or further network exploitation.

Fix

Upgrade to a patched version of Quest KACE System Management Appliance or apply the necessary security patches provided by Quest Software.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains_any(tolower(body), "kace", "quest") and compare_versions(detected_version, "8.0.318")

Run it with nuclei: nuclei -id CVE-2018-11138 -u <target>

The full check

id: CVE-2018-11138

info:
  name: Quest KACE System Management Appliance 8.0.318 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
  impact: |
    An attacker can execute arbitrary commands on the affected system, potentially leading to complete system compromise, data theft, or further network exploitation.
  remediation: |
    Upgrade to a patched version of Quest KACE System Management Appliance or apply the necessary security patches provided by Quest Software.
  reference:
    - https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
    - https://www.exploit-db.com/exploits/44950/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-11138
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11138
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-11138
    cwe-id: CWE-78
    epss-score: 0.91639
    epss-percentile: 0.99816
    cpe: cpe:2.3:a:quest:kace_system_management_appliance:8.0.318:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: quest
    product: kace_system_management_appliance
    fofa-query: icon_hash="-463230636"
  tags: cve,cve2018,quest,kace,rce,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_any(tolower(body), "kace", "quest")'
          - 'compare_versions(detected_version, "8.0.318")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: detected_version
        group: 1
        regex:
          - '\?build=([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from