CVE-2021-42855— Local privilege escalation due to misconfigured write permission on .debug_command.config file
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-42855
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local privilege escalation due to misconfigured write permission on .debug_command.config file
Source: NVD (National Vulnerability Database)
Vulnerability Description
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
访问控制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Aternity SteelCentral AppInternals 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Aternity SteelCentral AppInternals是美国Aternity公司的一个监控现代自动化解决方案。提供应用程序性能监控 (APM) 和诊断。 Aternity SteelCentral AppInternals Dynamic Sampling Agent (DSA) 存在安全漏洞，该漏洞源于配置文件可以将相应的 ID 映射到要执行的命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Aternity | SteelCentral AppInternals Dynamic Sampling Agent | 10.x | - |
II. Public POCs for CVE-2021-42855
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-42855
请登录查看更多情报信息。
Other References for CVE-2021-42855 (1)
Same Patch Batch · Aternity · 2022-03-09 · 7 CVEs total
| CVE-2021-42786 | 9.8 CRITICAL | Remote Code Execution at AgentControllerServlet |
| CVE-2021-42854 | 9.8 CRITICAL | Directory Traversal Read/Write/Delete at PluginServlet |
| CVE-2021-42787 | 9.4 CRITICAL | Directory Traversal Write/Delete/Partial Read at AgentConfigurationServlet |
| CVE-2021-42853 | 9.1 CRITICAL | Directory Traversal Delete/Read at AgentDiagnosticServlet |
| CVE-2021-42857 | 5.3 MEDIUM | Directory Traversal Partial Write at AgentDaServlet |
| CVE-2021-42856 | 4.7 MEDIUM | Reflected Cross-site Scripting at DsaDataTest |
IV. Related Vulnerabilities
Same product: SteelCentral AppInternals Dynamic Sampling Agent
- CVE-2021-42854
Directory Traversal Read/Write/Delete at PluginServlet - CVE-2021-42856
Reflected Cross-site Scripting at DsaDataTest - CVE-2021-42787
Directory Traversal Write/Delete/Partial Read at AgentConfig - CVE-2021-42857
Directory Traversal Partial Write at AgentDaServlet - CVE-2021-42786
Remote Code Execution at AgentControllerServlet
Same vendor: Aternity
- CVE-2021-42854
Directory Traversal Read/Write/Delete at PluginServlet - CVE-2021-42856
Reflected Cross-site Scripting at DsaDataTest - CVE-2021-42787
Directory Traversal Write/Delete/Partial Read at AgentConfig - CVE-2021-42857
Directory Traversal Partial Write at AgentDaServlet - CVE-2021-42786
Remote Code Execution at AgentControllerServlet
Same weakness: CWE-284
- CVE-2026-47261
Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRIT - CVE-2026-5230
Improper Access Control in Mia Technologies' Pizzy Library - CVE-2026-12212
hcengineering Huly Platform RPC operations.ts getMailboxSecr - CVE-2026-53520
Nezha Monitoring: Authenticated users can claim the dashboar - CVE-2026-44783
Discourse: Replying to a whisper lets non-whisperers create
V. Comments for CVE-2021-42855
No comments yet