[FD] (Reprise License Manager) RLM 14.2 - Authenticated Remote Binary Execution

[Gionathan Reale via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

# Product:  Reprise License Manager 14.2# Vendor:   Reprise Software
# CVE ID:   CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, 
Andreas Fyhn Andersen, Oliver Lind Nordestgaard  
# Date:   2021-11-25
#############################################################
Introduction:
When editing the license file, it is possible for an admin user to enable an 
option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when 
triggering the "Reread/Restart Servers" function on the webserver. 
(Exploitation does not require CVE-2018-15573, because the license file is 
meant to be changed in the application.)

Vulnerability:
A license file containing the following, would execute calc.exe as an example 
of this vulnerability, it is also possible to provide arguments to the 
executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and 
then executed. 

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely 
required.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/