CVE-2021-34164
📋 TL;DR
This vulnerability in LIZHIFAKA v2.2.0 allows authenticated attackers to execute arbitrary commands through the set password function in the admin interface. Attackers with admin credentials can exploit this to gain full system control. All systems running the vulnerable version are affected.
💻 Affected Systems
- LIZHIFAKA
📦 What is this software?
Lizhifaka by Lizhifaka Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, or use as a foothold for lateral movement within the network.
Likely Case
Unauthorized command execution allowing attackers to modify system files, steal sensitive data, or install backdoors.
If Mitigated
Limited impact if proper network segmentation and least privilege access controls are implemented.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.2.1 or later
Vendor Advisory: https://github.com/lizhipay/faka/issues/22
Restart Required: Yes
Instructions:
1. Backup current installation and data. 2. Download latest version from official repository. 3. Replace vulnerable files with patched version. 4. Restart the application service.
🔧 Temporary Workarounds
Disable admin email functionality
allRemove or restrict access to the vulnerable email password function
# Modify application code to disable /admin/index/email endpoint
Implement WAF rules
allBlock suspicious command injection patterns in admin endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LIZHIFAKA from critical systems
- Enforce multi-factor authentication for all admin accounts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if running LIZHIFAKA v2.2.0 by examining version files or application metadataCheck Version:
Check application configuration files or use: grep -r 'version' /path/to/lizhifaka/Verify Fix Applied:
Confirm version is v2.2.1 or later and test that command injection attempts in admin email function are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in application logs
- Multiple failed authentication attempts followed by successful admin login
- Suspicious POST requests to /admin/index/email endpoint
Network Indicators:
- Unexpected outbound connections from LIZHIFAKA server
- Command and control traffic patterns
SIEM Query:
source="lizhifaka.logs" AND (url_path="/admin/index/email" OR cmd_exec=*)