CVE-2018-18555

A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account.

CVSS v3 9.9 CRITICAL
CVSS v2.0 9.0 HIGH

9.9^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases	Exploit Vendor Advisory
https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:vyos:vyos:1.1.8:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-12-17 19:29

Updated : 2024-11-21 03:56

NVD link : CVE-2018-18555

Mitre link : CVE-2018-18555

CVE.ORG link : CVE-2018-18555

JSON object : View

Products Affected

vyos

vyos

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2018-18555", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2018-12-17T19:29:00.580", "references": [{"url": "https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A sandbox escape issue was discovered in VyOS 1.1.8. It provides a restricted management shell for operator users to administer the device. By issuing various shell special characters with certain commands, an authenticated operator user can break out of the management shell and gain access to the underlying Linux shell. The user can then run arbitrary operating system commands with the privileges afforded by their account."}, {"lang": "es", "value": "Se ha descubierto un problema de escape del sandbox en VyOS 1.1.8. Proporciona un shell restringido de navegaci\u00f3n para que los usuarios operadores administren el dispositivo. Mediante el env\u00edo de varios caracteres shell especiales con ciertos comandos, un usuario operador autenticado puede escapar del shell de gesti\u00f3n y obtener acceso al shell de Linux subyacente. El usuario puede ejecutar comandos arbitrarios del sistema operativo con los privilegios permitidos por su cuenta."}], "lastModified": "2024-11-21T03:56:08.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vyos:vyos:1.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7959038B-A2A9-49EE-9684-56209F2A7CC2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}