CVE-2018-1640

Vulnerability

In IBM Security Privileged Identity Manager Virtual Appliance version 2.2.1, a remote authenticated attacker can inject arbitrary operating system commands. The vulnerability resides in the way the appliance handles specially-crafted requests. The issue is fixed in version 2.2.1 as described in the vendor security bulletin [1].

Exploitation

The attacker must have valid credentials to the appliance. No user interaction beyond sending the crafted request is required. The attacker sends a specially-crafted HTTP request to an affected endpoint, triggering command execution on the underlying system [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the system with the privileges of the appliance process. This can lead to full compromise of the appliance, including data disclosure, modification, or denial of service [1].

Mitigation

IBM has released a fix for this vulnerability as part of an update for version 2.2.1. Affected users should apply the fix as described in the IBM Security Bulletin [1]. No workarounds are provided in the reference. No evidence currently lists this CVE on the CISA Known Exploited Vulnerabilities (KEV) catalog.