ZDI-CAN-9593: Cisco UCS Director CopyFileRunnable run Symlink Following Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco UCS Director. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of tar files by the LargeFileUploadServlet endpoint. The issue results from the lack of proper validation of a user-supplied UNIX symbolic link prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the tomcat service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-9593?
The severity of ZDI-CAN-9593 is critical because it allows remote attackers to execute arbitrary code without authentication.
How do I fix ZDI-CAN-9593?
To fix ZDI-CAN-9593, Cisco recommends upgrading to the latest version of UCS Director that includes the security patches.
What products are affected by ZDI-CAN-9593?
ZDI-CAN-9593 specifically affects installations of Cisco UCS Director.
Can ZDI-CAN-9593 be exploited without authentication?
Yes, ZDI-CAN-9593 can be exploited without the need for authentication by remote attackers.
What is the nature of the flaw in ZDI-CAN-9593?
The flaw in ZDI-CAN-9593 exists within the processing of tar files by the LargeFileUploadServlet endpoint.