CVE-2022-24388
📋 TL;DR
This vulnerability allows an attacker with user-level CLI access to inject root-level commands via the rconfig 'date' parameter in Fidelis Network and Deception components. It affects CommandPost, Collector, Sensor, Sandbox, and neighboring Fidelis components. Users of versions prior to 9.4.5 are at risk.
💻 Affected Systems
- Fidelis Network CommandPost
- Fidelis Network Collector
- Fidelis Network Sensor
- Fidelis Network Sandbox
- Fidelis Deception CommandPost
- Fidelis Deception Collector
- Fidelis Deception Sensor
- Fidelis Deception Sandbox
📦 What is this software?
Deception by Fidelissecurity
Network by Fidelissecurity
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level command execution, enabling data theft, lateral movement, and persistent backdoor installation.
Likely Case
Privilege escalation from user to root access, allowing attackers to execute arbitrary commands and potentially compromise the entire Fidelis deployment.
If Mitigated
Limited impact if proper access controls restrict CLI access and network segmentation isolates vulnerable components.
🎯 Exploit Status
Exploitation requires existing user-level CLI access; command injection via rconfig date parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4.5
Vendor Advisory: https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
Restart Required: Yes
Instructions:
1. Download patch from Fidelis support portal. 2. Apply patch to all affected components. 3. Restart services/components as required.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrators only using RBAC and network controls.
Network Segmentation
allIsolate Fidelis components from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls to limit CLI access to essential personnel only.
- Monitor CLI activity logs for suspicious command injection patterns.
🔍 How to Verify
Check if Vulnerable:
Check Fidelis component version via admin interface or CLI; if version is below 9.4.5, system is vulnerable.Check Version:
fidelis-version-check (specific command may vary by component)Verify Fix Applied:
Verify version is 9.4.5 or higher after patch application and test rconfig date functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI activity from non-admin users
- Command injection patterns in rconfig date parameter logs
- Privilege escalation attempts
Network Indicators:
- Unexpected outbound connections from Fidelis components
- Anomalous traffic patterns post-CLI access
SIEM Query:
source="fidelis_logs" AND (event="cli_access" OR command="rconfig date") AND user!="admin"