CSV injection in Avaya Call Management System (CMS). CVE-2023-3527

By -

 Hi All,

I was able to identify CVS injection vulnerability in Avaya Call Management System (CMS). Avaya Call Management System (CMS) is an integrated analysis and reporting solution that keeps you in touch with virtually everything that’s going on in your contact center from evaluating the performance of a single agent or group of agents to managing a contact center with multiple locations worldwide.

During the security assessment of CMS Supervisor Web application, i noted that whole section of "Administration" has a feature to download the content in CSV format. Any malicious user can inject malicious CSV payload, which will be executed if the admin downloads the csv report and opens it.

The Excel will ask the admin to enable the content, since the report is downloaded from trusted source he will click on enable which will execute the content.

Vulnerability and Fixed:

Vulnerability Name: CMS is vulnerable to CSV Injection
Assigned CVE: CVE-2023-3527
ASA Number: ASA-2023-087
Affected product: CMS Supervisor Web R19
CMS server release: cms-R19.2.0.2-Lgd.i
CMS web client release: cmsweb-R19.2.0.2-web19gd.i
Build Version: 19.2.0 2789
Build Time: 10/19/2021, 11:55:09 PM

Acknowledgement and fixed release page: https://support.avaya.com/css/public/documents/101086364

Fix details:

Product: Vulnerable Version(s): Resolution: Information:
Avaya CMS R19.x.x.x Upgrade to 20.0.0.0 or later Call Management System 20.0.x downloads

Below are the technical details:

Go to Administration section -> Click on Dictionary -> click on ACDs -> modify of create new ACD -> enter any value in the fields


Capture the request and put csv injection payload in description. For testcase I have used "=cmd|' /C notepad'!'A1'" payload which will only open the Notepad.


Forward the request to server and you will get the success response.

In browser download/Export the ACDs report 


Open the excel file and click on ENABLE, it will execute the payload. 



Thanks










Comments

Post a Comment

Popular posts from this blog

Ericsson BSCS iX R18 Billing & Rating (ADMX, MX) - Stored XSS (CVE-2020-29144, CVE-2020-29145)

By -
Image
Dear Reader, I was able to identify stored XSS in multiple web base modules of Ericsson BSCS iX R18 Billing & Rating platform  Below are its details: # Software description: Ericsson Billing is a convergent billing solution for telecoms that combines an unrivaled combination of out-of-the box features and high configurability. As an evolution of the widely-installed Ericsson BSCS iX, Ericsson Billing provides a low-risk but effective route to capture and secure revenue streams and take advantage of business opportunities from both traditional telecom services as well as digital services, 5G and IoT. # Technical Details & Impact: There are multiple web base modules in BSCS iX e.g. ADMX, MX (monitoring center), CX etc. It was observed that ADMX and MX are vulnerable to stored XSS, In most test cases session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or exploiting admin's browsers using beef...
Read more

Enjay CRM 1.0 - Multiple code executions via Unrestricted Terminal

By -
Image
  Enjay CRM is a collection which contains the CRM software along with Linux Ubuntu, however normal user don't have access to the underlying OS. Once the OS boots its runs the Enjay CRM software which has multiple read-only options.  However some of these options opens a terminal to perform a specific activity, This terminal is unrestricted and user can access the underlying OS as a ROOT and can run any command on OS. Underlying OS can be accessed using two methods; Also CVEs are assigned to these findings. 1. Using Ping menu (CVE-2024-41308):  it will open a terminal and user can click on File menu -> New Tab/New window. And root level terminal will be open. 2. Using Hardware info (CVE-2024-41309): Once the Hardware info page opens click on Help menu and either select "Open HardInfo Website" or "Report bug", it will open an unrestricted terminal where user can click on File menu -> New Tab/New window. And root level terminal will be open. Both the vulner...
Read more

NetSkope Unauthenticated CSV Injection in Admin UI (CVE-2020-28845)

By -
Image
This post is related to CSV injection in netskope Admin UI (Version 75.0) where an unauthenticated user can inject malicious payload in audit logs of admin portal and once the admin extract and open the report, the malicious payload will be executed. CVE ID : CVE-2020-28845 Test case : The audit logs consist of login attempts which includes username, for test case I have injected a non-malicious payload in username field, this payload was reflecting in audit logs and was executed once we download and open the report. Exploitation :  In below screenshot you can see a sample csv injection payload and a dummy password. To verify if our payload is reflecting in Audit logs of admin portal, we logged-in as an admin and in below screenshot our payload can be seen    Admin of Netskope admin extracted and downloaded the report.  Admin opens the downloaded reported and our payload got executed. This Vulnerability has been fixed now in the latest version of NetSkope and CVE ID ...
Read more