#VU37774 OS Command Injection in OTRS and Debian Linux - CVE-2017-16921

Vulnerability identifier: #VU37774

Vulnerability risk: High

CVSSv4.0: 7.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2017-16921

CWE-ID: CWE-78

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
OTRS
Web applications / Other software
Debian Linux
Operating systems & Components / Operating system

Vendor: otrs.org
Debian

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.

Mitigation
Install update from vendor's website.

Vulnerable software versions

OTRS: 4.0.1 - 6.0.1

Debian Linux: 4.0.1 - 9.0

---

External links
https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html
https://www.debian.org/security/2017/dsa-4066
https://www.exploit-db.com/exploits/43853/
https://www.otrs.com/security-advisory-2017-09-security-update-otrs-framework/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.