[FD] Security advisory: Authenticated RCE (command injection) in Kerio Connect 10.0.9 Patch 2 (build 10320) (GFI Software)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Kerio 
Connect 10.0.9 Patch 2 (build 10320) (GFI Software). The research is published 
and a proof-of-concept is available.

Authenticated RCE (command injection) (CVSS 8.8, authenticated)

Kerio Connect 10.0.9 Patch 2 contains a command-injection vulnerability in the 
WebAdmin JSON-RPC method Server.startEncryption. The password parameter is 
double-quoted and concatenated unescaped into a cryptsetup shell command that 
is executed via system() during volume encryption. Because the mail server 
process runs as root, a FullAdmin user can break out of the quotes and execute 
arbitrary commands as root. Dynamically verified.

Impact: Arbitrary command execution as root on the mail server host. An 
attacker with admin access can read mail stores and credentials, disrupt mail 
service, and take full control of the server.

Advisory: 
https://0day-rubbish.com/blog/kerio-connect-startencryption-cmd-injection-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE ID is pending.

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/