CVE-2021-3855

CVE-2021-3855 is a command injection vulnerability in the Liman Central Management System (MYS). The flaw resides in the HTTP/Controllers, CronMail, and Jobs modules, where user-supplied input is not properly neutralized before being used in system commands. This type of vulnerability, classified as CWE-77, allows an attacker to inject arbitrary operating system commands through specific endpoints. [1]

Exploitation of this vulnerability requires no authentication? The advisory does not specify authentication requirements, but given the modules involved (HTTP/Controllers, CronMail, Jobs) and the high CVSS score of 8.8, it is likely that an unauthenticated or low-privileged attacker can reach the vulnerable functionality over the network. The attack complexity is low, and no user interaction is needed. [1]

Successful exploitation enables remote code execution (RCE) on the Liman server. An attacker can execute arbitrary commands with the privileges of the 'liman' user. This can lead to full compromise of the Liman management system, including access to sensitive configuration data, the ability to modify system settings, and lateral movement within the network. [1]

The vulnerability affects Liman MYS versions from 1.7.0 up to (but not including) 1.8.3-462. The vendor released a fix in version 1.8.2-462. Users are strongly advised to update to the latest version to mitigate the risk. [1]