CVE-2021-31580 : What You Need to Know

Akkadian Provisioning Manager Engine (PME) is affected by a vulnerability that allows a bypass of the restricted shell by switching the OpenSSH channel from

shell

to

exec

. This could potentially lead to OS command injection. Here's what you need to know about CVE-2021-31580.

Understanding CVE-2021-31580

This CVE details a security issue in the Akkadian Provisioning Manager Engine (PME) that enables a shell escape via the 'exec' command.

What is CVE-2021-31580?

The restricted shell provided by Akkadian PME can be bypassed by changing the OpenSSH channel from

shell

to

exec

and providing a single execution parameter to the ssh client. The vulnerability was addressed in later versions of Akkadian products.

The Impact of CVE-2021-31580

The CVSS v3.1 base score for this vulnerability is 8.7, indicating a high severity level. It can lead to high confidentiality and integrity impact, with privileges required for exploitation being high.

Technical Details of CVE-2021-31580

This section covers the technical aspects of the CVE.

Vulnerability Description

The vulnerability allows attackers to manipulate the OpenSSH channel in Akkadian PME, resulting in the bypass of the restricted shell and potential OS command injection.

Affected Systems and Versions

Akkadian Provisioning Manager Engine (PME) versions 4.50.18 and below are known to be affected by this vulnerability. Later versions, including Akkadian PM 5.0.2 and Akkadian Appliance Manager 3.3.0.314-4a349e0, are secure.

Exploitation Mechanism

By exploiting this vulnerability, threat actors can execute arbitrary commands by sending the OpenSSH channel to

exec

instead of

shell

and providing an execution parameter.

Mitigation and Prevention

Protecting your systems from CVE-2021-31580 is crucial to maintain security.

Immediate Steps to Take

Ensure all Akkadian PME instances are updated to versions where the vulnerability is patched. Monitor for any suspicious activities that might indicate exploitation.

Long-Term Security Practices

Implement strong access controls, monitor network traffic for anomalies, and conduct regular security assessments to detect and mitigate similar vulnerabilities.

Patching and Updates

Frequently check for security updates from Akkadian and apply them promptly to keep the environment secure.