CVE-2019-20504
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Quest KACE K1000 Systems Management Appliances by injecting shell metacharacters into the kuid parameter of the service/krashrpt.php endpoint. It affects all organizations running vulnerable versions of the K1000 appliance, which is commonly used for IT asset management and system administration.
💻 Affected Systems
- Quest KACE K1000 Systems Management Appliance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to gain root access, deploy ransomware, exfiltrate sensitive data, and pivot to other internal systems.
Likely Case
Remote code execution leading to data theft, installation of backdoors, or disruption of IT management functions.
If Mitigated
Limited impact if network segmentation prevents external access and proper input validation is implemented.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. The vulnerability requires no authentication and uses simple command injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4 SP3 (version 6.4.120822) or later
Vendor Advisory: https://support.quest.com/kace-systems-management-appliance/kb/335965/security-advisory-for-kace-sma-v6-4
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download the 6.4 SP3 update from Quest support portal. 3. Apply the update through the K1000 administrative interface. 4. Restart the appliance as prompted. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
linuxUse web application firewall or network firewall to block access to /service/krashrpt.php
iptables -A INPUT -p tcp --dport 80 -m string --string "/service/krashrpt.php" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/service/krashrpt.php" --algo bm -j DROP
Input validation at proxy level
allConfigure reverse proxy to sanitize kuid parameter values
# Apache mod_security rule: SecRule ARGS:kuid "[;|&`$()]" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Isolate the K1000 appliance in a separate network segment with strict firewall rules limiting access to authorized administrators only.
- Implement network-based intrusion detection/prevention systems to monitor for exploitation attempts and block malicious traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check the appliance version in the K1000 administrative interface under Help > About. If version is below 6.4.120822, the system is vulnerable.Check Version:
ssh admin@k1000-ip 'cat /etc/version' or check via web interfaceVerify Fix Applied:
Verify version is 6.4.120822 or higher and test that the /service/krashrpt.php endpoint properly validates the kuid parameter.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /service/krashrpt.php with shell metacharacters in parameters
- System logs showing unexpected command execution or process creation
Network Indicators:
- HTTP requests containing shell metacharacters (;, |, &, `, $, (, )) in the kuid parameter
- Outbound connections from the K1000 appliance to suspicious external IPs
SIEM Query:
source="k1000-logs" AND (url="/service/krashrpt.php" AND (param="*;*" OR param="*|*" OR param="*&*" OR param="*`*" OR param="*$(*"))