CVE-2022-31795: fujitsu eternus_cs8000_firmware OS Command Injection

Vulnerability summary

CVE-2022-31795 is a high (CVSS 10.0) OS Command Injection vulnerability in fujitsu eternus_cs8000_firmware. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-06-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.