CVE-2020-29495

Vulnerability

CVE-2020-29495 is an OS command injection vulnerability in the Fitness Analyzer component of DELL EMC Avamar Server, versions 19.1, 19.2, and 19.3 [1]. The vulnerability exists because user-supplied input is not properly sanitized before being passed to system commands, allowing an attacker to inject arbitrary OS commands [1]. No authentication or special configuration is required to trigger the vulnerable code path, as the Fitness Analyzer functionality is accessible to unauthenticated remote users [1].

Exploitation

An attacker can exploit this vulnerability remotely over the network without any prior authentication or user interaction [1]. The attacker sends a crafted request to the Fitness Analyzer endpoint, embedding malicious OS commands in the parameters. Due to insufficient input validation, the injected commands are executed on the underlying operating system with the high privileges of the Avamar application service [1]. No specific network position beyond reachability to the Avamar server is required.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands with high (root-equivalent) privileges on the vulnerable Avamar Server [1]. This compromises the confidentiality, integrity, and availability of the application and its underlying operating system. The attacker can fully control the server, steal or delete sensitive backup data, install malware, and pivot to other systems on the network. The CVSS v3.1 base score is 10.0 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H [1].

Mitigation

Dell EMC has released a security update to address this vulnerability. Customers are strongly recommended to upgrade Avamar Server to a fixed version as soon as possible [1]. The advisory (DSA-2020-272) provides details on obtaining the update. No workaround or mitigation other than applying the patch is documented in the available references [1]. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.