Pascom CPS - Local File Inclusion

highseverity

7.5CVSS score

10.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.

Impact

The vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information, execute arbitrary code, or perform other malicious activities.

Fix

Apply the latest security patches or updates provided by the vendor to fix the Local File Inclusion vulnerability in Pascom CPS.

How to confirm it

Send: GET /services/pluginscript/
Positive when: status_code_2 != status_code_1

Run it with nuclei: nuclei -id CVE-2021-45968 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45968

info:
  name: Pascom CPS - Local File Inclusion
  author: dwisiswant0
  severity: high
  description: |
    Pascom packaged with Cloud Phone System (CPS) versions before 7.20 contain a known local file inclusion vulnerability.
  impact: |
    The vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information, execute arbitrary code, or perform other malicious activities.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the Local File Inclusion vulnerability in Pascom CPS.
  reference:
    - https://kerbit.io/research/read/blog/4
    - https://www.pascom.net/doc/en/release-notes/
    - https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45968
    - https://jivesoftware.com/platform/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-45968
    cwe-id: CWE-918
    epss-score: 0.10385
    epss-percentile: 0.95764
    cpe: cpe:2.3:a:jivesoftware:jive:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: jivesoftware
    product: jive
  tags: cve2021,cve,pascom,lfi,jivesoftware,vuln

http:
  - raw:
      - |
        GET /services/pluginscript/ HTTP/1.1
        Host: {{Hostname}}
        GET /services/pluginscript/..;/..;/ HTTP/1.1
        Host: {{Hostname}}
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code_2 != status_code_1"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from