CVE-2018-6926: OS Command Injection
In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rhshellfix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable rh_shell_fix on affected RHEL/CentOS systems where MISP 2.4.87 is installed to prevent the server setting from permitting a PATH override that enables OS command injection.
Red Hat Enterprise Linux / CentOS rh_shell_fix = disabled - Compensating control
Restrict access to MISP site-administrator accounts: limit administrative access to trusted IP addresses via firewall rules or VPN, and remove unnecessary site-admin privileges to reduce the number of accounts that can reach the vulnerable setting.
- Operational
Audit site-administrator activity on the MISP instance: review application and system logs for commands invoked via app/Controller/ServersController.php, and if any suspicious or unauthorized activity is found, rotate credentials and API keys for affected administrator accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6926?
CVE-2018-6926 has been assigned a high severity due to the potential for arbitrary OS command injection.
How do I fix CVE-2018-6926?
To fix CVE-2018-6926, update MISP to a version later than 2.4.87 where the vulnerability has been patched.
Who is affected by CVE-2018-6926?
CVE-2018-6926 affects MISP version 2.4.87 running on Red Hat Enterprise Linux and CentOS with rh_shell_fix enabled.
What type of vulnerability is CVE-2018-6926?
CVE-2018-6926 is classified as a command injection vulnerability.
What are the implications of CVE-2018-6926?
The implications of CVE-2018-6926 include potential complete system compromise through the execution of arbitrary commands by site admins.