CVE-2020-11941
📋 TL;DR
CVE-2020-11941 is an OS command injection vulnerability in Open-AudIT's discovery functionality that allows authenticated attackers to execute arbitrary commands on the underlying operating system. This affects Open-AudIT installations version 3.2.2 and earlier. Attackers with network access to the Open-AudIT web interface can potentially gain full control of the server.
💻 Affected Systems
- Open-AudIT
📦 What is this software?
Open Audit by Opmantek
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Open-AudIT server leading to lateral movement within the network, data exfiltration, and deployment of persistent backdoors or ransomware.
Likely Case
Unauthorized command execution leading to privilege escalation, data theft, and potential compromise of other systems in the network.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and input validation are implemented.
🎯 Exploit Status
Exploit code is publicly available and requires authenticated access. The vulnerability is straightforward to exploit once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.0
Vendor Advisory: https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
Restart Required: Yes
Instructions:
1. Backup your Open-AudIT database and configuration. 2. Download Open-AudIT 3.3.0 or later from the official repository. 3. Follow the upgrade instructions in the release notes. 4. Restart the Open-AudIT service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable Discovery Module
allTemporarily disable the discovery functionality until patching can be completed.
# Modify Open-AudIT configuration to disable discovery features
# Check documentation for specific configuration changes
Restrict Access
linuxLimit network access to Open-AudIT to only trusted IP addresses or networks.
# Example firewall rule for Linux:
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Open-AudIT from critical systems
- Apply principle of least privilege to Open-AudIT service accounts and user permissions
🔍 How to Verify
Check if Vulnerable:
Check Open-AudIT version via web interface or by examining installed files. Versions 3.2.2 and earlier are vulnerable.Check Version:
# Check version via command line if accessible: grep -i version /path/to/open-audit/files/*Verify Fix Applied:
Verify version is 3.3.0 or later and test discovery functionality with malicious input to ensure proper input validation.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in system logs
- Discovery operations with suspicious parameters
- Multiple failed authentication attempts followed by discovery requests
Network Indicators:
- Unusual outbound connections from Open-AudIT server
- Traffic patterns indicating command and control communication
SIEM Query:
source="open-audit-logs" AND (event="discovery" AND (command="*;*" OR command="*|*" OR command="*`*"))🔗 References
- http://packetstormsecurity.com/files/157476/Open-AudIT-3.2.2-Command-Injection-SQL-Injection.html
- https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
- https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities
- http://packetstormsecurity.com/files/157476/Open-AudIT-3.2.2-Command-Injection-SQL-Injection.html
- https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v3.3.0
- https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities
