genieacs/genieacs · Security
OS Command Injection in GenieACS
- GHSA ID
- GHSA-2877-693q-pj33
- CVE ID
- CVE-2021-46704
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')