Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI 
Software). The research is published and a proof-of-concept is available.

Authenticated RCE (command injection) (CVSS 8.8, authenticated)

Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the WebAdmin JSON-RPC method 
Server.startEncryption. The password parameter is double-quoted and concatenated unescaped into a cryptsetup shell 
command that is executed via system() during volume encryption. Because the mail server process runs as root, a 
FullAdmin user can break out of the quotes and execute arbitrary commands as root. Dynamically verified.

Impact: Arbitrary command execution as root on the mail server host. An attacker with admin access can read mail stores 
and credentials, disrupt mail service, and take full control of the server.

Advisory: https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/