CVE-2022-24390
📋 TL;DR
This vulnerability allows authenticated attackers with CLI user-level access to execute arbitrary commands on Fidelis Network and Deception components. It affects CommandPost, Collector, Sensor, and Sandbox components in versions prior to 9.4.5.
💻 Affected Systems
- Fidelis Network CommandPost
- Fidelis Network Collector
- Fidelis Network Sensor
- Fidelis Network Sandbox
- Fidelis Deception CommandPost
- Fidelis Deception Collector
- Fidelis Deception Sensor
- Fidelis Deception Sandbox
📦 What is this software?
Deception by Fidelissecurity
Network by Fidelissecurity
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data exfiltration, lateral movement to other Fidelis components, and potential network-wide compromise.
Likely Case
Privilege escalation from user to administrative access, unauthorized command execution, and potential data access.
If Mitigated
Limited impact if proper network segmentation and access controls prevent lateral movement and command execution.
🎯 Exploit Status
Exploitation requires authenticated CLI access. The vulnerability is in the 'remote_text_file' parameter of rconfig.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4.5
Vendor Advisory: https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
Restart Required: Yes
Instructions:
1. Download patch from Fidelis support portal. 2. Apply patch to all affected components. 3. Restart services/components as required. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to only necessary administrative users
Network Segmentation
allIsolate Fidelis components from other critical systems
🧯 If You Can't Patch
- Implement strict access controls to limit CLI access to trusted administrators only.
- Monitor for unusual CLI activity and command execution patterns.
🔍 How to Verify
Check if Vulnerable:
Check component version via CLI or web interface. If version is below 9.4.5, system is vulnerable.Check Version:
fidelis-version or check via web admin interfaceVerify Fix Applied:
Verify version is 9.4.5 or higher after patch application. Test 'remote_text_file' parameter functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command execution patterns
- Multiple failed authentication attempts followed by successful CLI access
- Execution of unexpected system commands
Network Indicators:
- Unusual outbound connections from Fidelis components
- Lateral movement attempts to other Fidelis systems
SIEM Query:
source="fidelis_cli" AND (command="*remote_text_file*" OR command="*system*" OR command="*exec*")