CVE-2021-37443
📋 TL;DR
CVE-2021-37443 is a path traversal vulnerability in NCH IVM Attendant that allows attackers to delete arbitrary files on the server via the logdeleteselected check0 parameter. This affects all users running NCH IVM Attendant version 5.12 and earlier. The vulnerability enables file deletion without proper path validation.
💻 Affected Systems
- NCH IVM Attendant
📦 What is this software?
Ivm Attendant by Nchsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to service disruption, data loss, or operating system instability.
Likely Case
Deletion of application files causing service disruption, potential data loss, and possible privilege escalation if system files are targeted.
If Mitigated
Limited to application directory if proper file permissions are configured, causing only application-specific disruption.
🎯 Exploit Status
Simple HTTP request manipulation required, no authentication needed based on available PoC.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.13 or later
Vendor Advisory: https://www.nch.com.au/ivm/index.html
Restart Required: Yes
Instructions:
1. Download latest version from NCH website. 2. Backup configuration. 3. Install update. 4. Restart IVM Attendant service.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to block path traversal patterns
WAF rule: block requests containing '../' or '..\' in parameters
File Permission Restriction
allRestrict IVM Attendant process to only necessary directories
chmod 750 /path/to/ivm (Linux)
icacls "C:\Program Files\IVM" /deny Everyone:(OI)(CI)(DE) (Windows)
🧯 If You Can't Patch
- Isolate IVM Attendant on separate network segment with strict firewall rules
- Implement application-level input validation to sanitize the logdeleteselected parameter
🔍 How to Verify
Check if Vulnerable:
Check if version is 5.12 or earlier via web interface or installation directoryCheck Version:
Check Help > About in application or examine installation filesVerify Fix Applied:
Verify version is 5.13 or later and test parameter with traversal attempts📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' or '..\' in logdeleteselected parameter
- File deletion errors in application logs
Network Indicators:
- HTTP POST requests to IVM endpoints with path traversal patterns
SIEM Query:
source="web_logs" AND (uri="*logdeleteselected*" AND (param="*../*" OR param="*..\\*"))