CVE-2021-32829

{"id": "CVE-2021-32829", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "published": "2021-08-17T16:15:07.063", "references": [{"url": "https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html", "tags": ["Not Applicable"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zstackio/zstack/security/advisories/GHSA-6xgq-7rqg-x3q5", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2021-065-zstack/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters, managing resources of compute, storage, and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution (RCE) via bypass of the Groovy shell sandbox. The REST API exposes the GET zstack/v1/batch-queries?script endpoint which is backed up by the BatchQueryAction class. Messages are represented by the APIBatchQueryMsg, dispatched to the QueryFacadeImpl facade and handled by the BatchQuery class. The HTTP request parameter script is mapped to the APIBatchQueryMsg.script property and evaluated as a Groovy script in BatchQuery.query the evaluation of the user-controlled Groovy script is sandboxed by SandboxTransformer which will apply the restrictions defined in the registered (sandbox.register()) GroovyInterceptor. Even though the sandbox heavily restricts the receiver types to a small set of allowed types, the sandbox is non effective at controlling any code placed in Java annotations and therefore vulnerable to meta-programming escapes. This issue leads to post-authenticated remote code execution. For more details see the referenced GHSL-2021-065. This issue is patched in versions 3.8.21, 3.10.8, and 4.1.0."}, {"lang": "es", "value": "ZStack es un software IaaS (infraestructura como servicio) de c\u00f3digo abierto cuyo objetivo es automatizar los centros de datos, administrando los recursos de computaci\u00f3n, almacenamiento y red, todo ello mediante API. Las versiones afectadas de la API REST de ZStack son vulnerables a una ejecuci\u00f3n de c\u00f3digo remota (RCE) despu\u00e9s de la autenticaci\u00f3n, por medio de una omisi\u00f3n del sandbox shell de Groovy. La API REST expone el endpoint GET zstack/v1/batch-queries?script que est\u00e1 respaldado por la clase BatchQueryAction. Los mensajes son representados por el APIBatchQueryMsg, enviados a la fachada QueryFacadeImpl y manejados por la clase BatchQuery. El script del par\u00e1metro de petici\u00f3n HTTP se asigna a la propiedad APIBatchQueryMsg.script y se eval\u00faa como un script Groovy en BatchQuery.query la evaluaci\u00f3n del script Groovy controlado por el usuario es sandboxed por SandboxTransformer que aplicar\u00e1 las restricciones definidas en el registrado (sandbox.register()) GroovyInterceptor. A pesar de que el sandbox restringe fuertemente los tipos del receptor a un peque\u00f1o conjunto de tipos permitidos, el sandbox no es efectivo en el control de cualquier c\u00f3digo colocado en las anotaciones de Java y por lo tanto es vulnerable a los escapes de meta-programaci\u00f3n. Este problema conlleva a una ejecuci\u00f3n de c\u00f3digo remota post-autenticada. Para m\u00e1s detalles, consulte la referencia GHSL-2021-065. Este problema est\u00e1 parcheado en versiones 3.8.21, 3.10.8 y 4.1.0."}], "lastModified": "2022-10-25T15:55:57.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zstack:rest_api:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1601C476-2420-4656-83A5-B5D4CC92B288", "versionEndExcluding": "3.8.21", "versionStartIncluding": "2.2.4"}, {"criteria": "cpe:2.3:a:zstack:rest_api:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "846C8789-672B-429D-BA03-54FF2E38BB37", "versionEndExcluding": "3.10.8", "versionStartIncluding": "3.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}