Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execut

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• accellion secure file transfer appliance7_0_135
• accellion secure file transfer appliance7_0_178
• accellion secure file transfer appliance7_0_189
• accellion secure file transfer appliance7_0_259
• accellion secure file transfer appliance7_0_296

Other highest-scoring records for the same primary product.

• CVE-2009-4646Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authentica
  37Monitor
• CVE-2008-7012courier/1000@/api_error_email.html (aka "error reporting page") in Accellion File Transfer Appliance FTA_7_0_178, and possibly other version
  33Monitor
• CVE-2009-4645Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote att
  32Monitor
• CVE-2009-4648Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with
  28Monitor
• CVE-2009-4647Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitr
  17Monitor
• CVE-2008-3850Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA_7_0_135 allows remote attackers to inject arbitrary web script or HT
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.