CVE-2020-16147
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary code with root privileges on Telmat AccessLog systems via the login page. It affects Telmat AccessLog version 6.0 and earlier (specifically TAL_20180415). Attackers can gain complete control over affected systems without any credentials.
💻 Affected Systems
- Telmat AccessLog
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root shell access, allowing data theft, ransomware deployment, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to system takeover, credential harvesting, and use as pivot point for network attacks.
If Mitigated
Limited impact if system is isolated, monitored, and has strict network controls, though root access still poses significant risk.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 6.0 (TAL_20180415)
Vendor Advisory: https://podalirius.net/cves/2020-16147/
Restart Required: Yes
Instructions:
1. Contact Telmat for updated version. 2. Backup configuration. 3. Install updated version. 4. Restart service. 5. Verify fix.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to Telmat AccessLog login page
iptables -A INPUT -p tcp --dport [TELMAT_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [TELMAT_PORT] -j DROP
Web Application Firewall
allDeploy WAF to block injection attempts
🧯 If You Can't Patch
- Immediately isolate system from internet and restrict internal network access
- Implement strict monitoring and alerting for suspicious login page activity
🔍 How to Verify
Check if Vulnerable:
Check version in web interface or configuration files. If version is <= 6.0 or shows TAL_20180415, system is vulnerable.Check Version:
Check web interface or grep for version in configuration files: grep -r 'version\|TAL' /opt/telmat/ /etc/telmat/Verify Fix Applied:
Verify version is updated beyond 6.0 and test login page for injection attempts (in controlled environment).📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to login page with shell commands
- Failed login attempts with command injection patterns
- Sudden root shell activity from web service user
Network Indicators:
- Unusual outbound connections from Telmat server
- Shell command patterns in HTTP requests to login endpoint
SIEM Query:
source="telmat_accesslog" AND (url_path="/login" AND (http_method="POST") AND (content CONTAINS "$" OR content CONTAINS "|" OR content CONTAINS ";"))