Vulnerabilities Found in GOautodial
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33177 +1 in the same advisory: …33179 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries. NVD description · AI analysis pending | 8.8 group max | 10% |
| — | ||
| CVE-2021-33178 | The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of this results in a malicious actor having the ability to arbitrarily delete files on the local system. NVD description · AI analysis pending | 6.5 | 2% |
| — | ||
| CVE-2021-43176 +1 in the same advisory: …43175 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and l The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C NVD description · AI analysis pending | 8.8 group max | 1% | PoC |
| — |
Full article345 words · extracted from infosecurity-magazine.com · click to collapse
A cybersecurity researcher has discovered multiple vulnerabilities in an open-source call center software suite used around the world.
The Synopsys Cybersecurity Research Center (CyRC) released an advisory today exposing two API vulnerabilities in GOautodial. While multiple providers sell GOautodial as a paid-for cloud service, it is available as a free download.
"The vulnerabilities discovered can be exploited remotely to read system settings without authentication and allow arbitrary code execution by any authenticated user via unrestricted file upload," wrote researchers in the GOautodial advisory.
Among the vulnerabilities unearthed by Synopsys is the broken authentication flaw CVE-2021-43175, which allows attackers with access to the internal network hosting GOautodial to steal sensitive configuration data, such as default passwords, from the GOautodial server without credentials.
Using this data, a threat actor could connect to other related systems on the network, such as VoIP phones.
Another newly found flaw is CVE-2021-43176, which allows any authenticated user at any level to perform remote code execution.
"This would allow them to gain complete control over the GOautodial application on the server, steal the data from fellow employees and customers, and even rewrite the application to introduce malicious behavior such as stealing passwords or spoofing communications (sending messages or emails that look like they come from someone else)," warned CyRC.
Vulnerable versions of the GOautodial API are those created prior to September 27, 2021, including the latest publicly available ISO installer, GOautodial-4-x86_64-Final-20191010-0150.iso.
Scott Tolley, a researcher from the Synopsys Cybersecurity Research Center, discovered the vulnerabilities using the interactive application security testing (IAST) tool Seeker, which automatically tests for security vulnerabilities during the software development life cycle (SDLC).
Tolley's initial disclosure of the vulnerabilities to GOautodial took place on September 22. The company responded on October 20, saying that the vulnerabilities had been fixed.
Synopsys validated the fix by November 17, then published its advisory regarding the vulnerabilities earlier today.
Other vulnerabilities discovered by keen bug-hunter Tolley include CVE-2021-33177, CVE-2021-33178, and CVE-2021-33179, which are SQL injection, path traversal, and XSS vulnerabilities in the popular application, service, and network monitoring software Nagios XI.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/vulnerabilities-found-in-goautodial/