Vulnerability Key Information Vulnerability Name: NitroSecurity ESM 8.4.0a - Remote Code Execution Edb-ID: 15318 CVE ID: 2010-4099 Author: FiliP Palian Vulnerability Type: Remote Code Execution Platform: Linux Release Date: 2010-10-26 Product Description NitroView ESM is an enterprise-grade Security Information and Event Management (SIEM) system that identifies, correlates, and mitigates threats in a shorter time frame than other SIEMs on the market. Issue Description During research, it was found that the Perl module "ess.pm" is vulnerable to remote code execution due to lack of user input validation. Research Environment This vulnerability was discovered and tested on ESM 8.4.0a (NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux). Requirements During research, the option "ESSPMDebug=1" must be set in the "/usr/local/ess/CPConsoleServer.cfg" file. No authentication is required on NitroSecurity Esm to successfully execute the attack. Technical Details Due to the "system()" call in the "ess.pm" module, sending a specially crafted request to the NitroSecurity ESM web interface can lead to remote command execution. Changing the IFS (Internal Field Separator) is required to exploit this vulnerability. Other methods are likely to be effective as well. Proof of Concept The following code successfully executed in the test environment (for testing purposes only; replace x.x.x.x with your NitroSecurity ESM IP address): Impact Remote code execution in the context of the user running the web server. CVSS Score 9 (AV:N/AC:L/Au:N/C:P/I:P/A:C) Disclosure Timeline 20100922: First contact with vendor 20100922: Vendor response 20100923: Vulnerability details and PoC sent to vendor 20100923: Vendor confirms vulnerability 20101008: Vendor releases patch 20101025: Security advisory published Acknowledgments This vulnerability was discovered by s_n ;-p.