^{CVE-2020-10789:}OS Command Injection Vulnerability in openITCOCKPIT's Web Terminal

Overview

The vulnerability exists in openITCOCKPIT's web terminal functionality where input validation is insufficient when handling user-supplied data that is passed to the 'su' command. The issue is specifically located in the app/Lib/SudoMessageInterface.php file where shell metacharacters are not properly sanitized before being used in command execution. An attacker with access to the web terminal could exploit this vulnerability to execute arbitrary commands with the privileges of the user running the openITCOCKPIT application, potentially leading to unauthorized access, data theft, or complete system compromise.

Remediation

To address this vulnerability, users should upgrade openITCOCKPIT to version 3.7.3 or later, which contains the security fix for this issue. If immediate upgrading is not possible, consider the following temporary mitigations:

1. Restrict access to the web terminal functionality to only trusted administrators
2. Implement network-level controls to limit access to the openITCOCKPIT interface
3. Monitor system logs for suspicious command execution patterns
4. Apply the patch manually by reviewing the fix in the referenced GitHub commit (73b5b34afa8bd82ff26c0097558341214c768cfc)

System administrators should also perform a security audit to determine if this vulnerability has been previously exploited in their environment.

References

1. Patch: https://github.com/it-novum/openITCOCKPIT/commit/73b5b34afa8bd82ff26c0097558341214c768cfc
2. Vendor Advisory: https://openitcockpit.io/2020/2020/03/23/openitcockpit-3-7-3-released/
3. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - https://cwe.mitre.org/data/definitions/78.html
4. OWASP Command Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html