CVE-2019-9189

Arbitrary Python script upload in Prima Systems FlexAir, versions 2.4.9api3 and prior, leads to full system access for authenticated attackers due to root code execution

• CVSS 8.8
• CWE-434 Unrestricted Upload of File with Dangerous Type
• Input Validation and Sanitization
• Remote

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.

CVE

CVE-2019-9189

CWE

CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS base score

8.8

Published

2019-06-05

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Prima Systems FlexAir to version 2.4.9api4 or higher.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

@misc{vaitp:cve20199189,
  title        = {{Arbitrary Python script upload in Prima Systems FlexAir, versions 2.4.9api3 and prior, leads to full system access for authenticated attackers due to root code execution}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-9189},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-9189/}}
}