JVN#41853173
OS command injection vulnerability in multiple Infoscience Corporation log management tools
Overview
Multiple log management tools provided by Infoscience Corporation contain an OS command injection vulnerability.
Products Affected
- Logstorage version 8.0.0 and earlier
- ELC Analytics version 3.0.0 and earlier
Description
Infoscience Corporation's multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads.
In a situation where the FTP upload function is enabled and there is a flaw of input value handling in the log processing, a remote attacker who can upload a crafted log via FTP may execute an arbitrary OS command on the server where the products are running (CWE-78).
Impact
When the FTP upload function is enabled and there is a flaw of input value handling in the log processing function "ScriptHandler", crafted log may be uploaded via FTP and an arbitrary OS command may be executed on the server where the products are running.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
Apply the Workaround
Applying the following workaround may mitigate the impact of this vulnerability.
- Set the file name patterns of which ScriptHandler processes not to be executed by the file names that include the comma.
Vendor Status
| Vendor | Link |
| Infoscience Corporation | Logstorage vulnerable to arbitrary file execution (In Japanese) |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2020-5626 |
| JVN iPedia |
JVNDB-2021-000007 |
Update History
- 2021/01/27
- Information under the section [Vendor Status] was modified.
- 2022/07/26
- The URL information under the section [Vendor Status] was updated.