CVE-2018-11144

Vulnerability

Quest DR Series Disk Backup software versions prior to 4.0.3.1 contain a command injection vulnerability (issue 2 of 46). The flaw resides in an unspecified component of the administrative interface, allowing an attacker to inject arbitrary operating system commands through crafted input. The software is used for disk backup operations.

Exploitation

An attacker with network access to the administrative interface can exploit this vulnerability without requiring authentication, as per the available reference [1]. By sending specially crafted requests, the attacker can bypass input sanitization and execute arbitrary commands on the underlying system. The exact steps are detailed in the referenced advisory.

Impact

Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the application. This can lead to full system compromise, including data exfiltration, installation of malware, or disruption of backup services. The impact is high due to the potential for remote code execution.

Mitigation

Quest has released version 4.0.3.1 to address this vulnerability. Users should upgrade to this version or later. No workarounds are mentioned in the available references. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.