CVE-2021-37840

aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/aaPanel/aaPanel/issues/74	Exploit Third Party Advisory
https://ssd-disclosure.com/ssd-advisory-aapanel-cswh-to-rce/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-08-02 14:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-37840

Mitre link : CVE-2021-37840

CVE.ORG link : CVE-2021-37840

JSON object : View

Products Affected

aapanel

aapanel

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-37840", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-08-02T14:15:07.570", "references": [{"url": "https://github.com/aaPanel/aaPanel/issues/74", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://ssd-disclosure.com/ssd-advisory-aapanel-cswh-to-rce/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome)."}, {"lang": "es", "value": "aaPanel versiones hasta 6.8.12, permite un ataque de tipo Cross-Site WebSocket Hijacking (CSWH) que involucra comandos del SO dentro de mensajes WebSocket en una URL ws:// para /webssh (la v\u00edctima debe tener configurado el Terminal con al menos un host). Una explotaci\u00f3n con \u00e9xito depende del navegador usado por la v\u00edctima potencial (por ejemplo, la explotaci\u00f3n puede ocurrir con Firefox pero no con Chrome)"}], "lastModified": "2021-08-10T18:29:56.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6F2C15D-0314-40CE-81A3-31427C3926B5", "versionEndIncluding": "6.8.12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}