(Reprise License Manager) RLM 14.2 - Authenticated Remote Binary Execution

[Gionathan Reale via Fulldisclosure <fulldisclosure () seclists org>]

# Product:  Reprise License Manager 14.2# Vendor:   Reprise Software
# CVE ID:   CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind 
Nordestgaard  
# Date:   2021-11-25
#############################################################
Introduction:
When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" 
function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be 
changed in the application.)

Vulnerability:
A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also 
possible to provide arguments to the executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and then executed. 

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely required.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/