CVE-2020-4636

Command injection in IBM Resilient OnPrem 38.2 via Python3 scripting

• CVSS 7.2
• CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
• Input Validation and Sanitization
• Remote

IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503.

CVE

CVE-2020-4636

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVSS base score

7.2

Published

2020-10-16

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to IBM Resilient OnPrem version 38.3 or higher

import subprocess

def execute_command(command):
    """Vulnerable function that demonstrates the security issue."""
    result = subprocess.run(command, shell=True, check=True, capture_output=True, text=True)
    return result.stdout

user_input = "ls -l; rm -rf /"
output = execute_command(user_input)
print(output)

import subprocess

BLACKLIST = ["rm", "shutdown", "reboot", "format", "reboot", "dd", "mkfs", "chmod", "chown"]

def execute_command(command):
    """Secure function that fixes the vulnerability."""
    command_list = command.split()
    if any(blacklisted in command_list for blacklisted in BLACKLIST):
        return "Error: Command contains blacklisted keywords."
    
    try:
        result = subprocess.run(command_list, check=True, capture_output=True, text=True)
        return result.stdout
    except subprocess.CalledProcessError as e:
        return f"Error: {e.stderr}"

user_input = "ls -l; rm -rf /"
output = execute_command(user_input)
print(output)

@misc{vaitp:cve20204636,
  title        = {{Command injection in IBM Resilient OnPrem 38.2 via Python3 scripting}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-4636},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-4636/}}
}