CVE-2021-31926

Vulnerability

The vulnerability resides in the AMP Application Deployment Service of CubeCoders AMP versions 2.1.x prior to 2.1.1.2. A remote, authenticated user can open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint, bypassing permission checks that normally restrict network configuration changes [1].

Exploitation

An attacker must have valid authentication credentials for the AMP instance. They can then send a crafted HTTP(S) request to the API endpoint responsible for port management, without needing the "change network configuration" permission. The exact sequence of steps is not publicly detailed, but the direct API call is sufficient to trigger the action [1].

Impact

Successful exploitation allows the attacker to open arbitrary ports in the local system firewall, potentially exposing services that were intended to be restricted. This increases the attack surface and could lead to unauthorized network access or further compromise [1].

Mitigation

The issue is fixed in CubeCoders AMP version 2.1.1.2. Users should upgrade to this version or later. No workaround is documented. The vulnerability was reported via GitHub issue #443 [1].