CVE-2020-10221
rConfig OS Command Injection Vulnerability
Description
CVE-2020-10221 is a high-severity OS command injection vulnerability affecting rConfig, an open-source network device configuration management tool. The vulnerability exists in the lib/ajaxHandlers/ajaxAddTemplate.php file, where insufficient input validation of the fileName POST parameter allows a remote authenticated attacker to inject and execute arbitrary operating system commands via shell metacharacters. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 91.39% (99.66th percentile), CVE-2020-10221 is among the most likely vulnerabilities to be exploited, posing a severe risk to organizations using rConfig for network management.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rconfig | rconfig | <= 3.9.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://cwe.mitre.org/data/definitions/78.html(Third Party Advisory)
- https://engindemirbilek.github.io/rconfig-3.93-rce(Exploit, Third Party Advisory)
- https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.html(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2020-10221, the rConfig application fails to sanitize shell metacharacters in the fileName POST parameter within the ajaxAddTemplate.php handler, allowing an authenticated user to append arbitrary OS commands that are executed by the web server process.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-10221 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, requires only low-level privileges (authenticated user access), and no user interaction. Confidentiality (High): Successful OS command injection enables an attacker to read any file accessible to the web server process, including configuration files containing network device credentials, database connection strings, and other sensitive data managed by rConfig. Integrity (High): Arbitrary command execution allows modification of system files, rConfig configurations, and potentially network device configurations managed by the tool, enabling supply-chain-style attacks on managed infrastructure. Availability (High): An attacker can disrupt rConfig services, delete critical configuration data, or use the compromised server as a pivot point for lateral movement within the network. The EPSS score of 91.39% indicates near-certain exploitation activity, making this a critical remediation priority for any organization running rConfig.
Exploit Maturity
CVE-2020-10221 has a mature exploit landscape with publicly available proof-of-concept code. CISA has confirmed active exploitation through its KEV catalog listing. Public exploit code is available via Packet Storm Security, and additional exploit documentation has been published by security researcher Engin Demirbilek. The EPSS score of 91.39% (99.66th percentile) indicates near-certain exploitation, placing this among the most actively targeted vulnerabilities. rConfig's role as a network configuration management tool makes it a particularly attractive target, as compromising it can grant access to credentials and configurations for all managed network devices.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade rConfig to a version newer than 3.9.4 that addresses this command injection vulnerability.
- If an immediate upgrade is not possible, restrict access to the rConfig web interface to trusted IP addresses only using firewall rules and network segmentation, and ensure the
ajaxAddTemplate.phpendpoint is not accessible to unauthorized users. - Implement a web application firewall (WAF) with rules to detect and block OS command injection patterns, particularly shell metacharacters (e.g.,
;,|,&&, backticks,$()) in POST parameters targeting the template management functionality. - Review web server and application logs for indicators of exploitation, including unusual process execution, unexpected file creation, or suspicious POST requests to
ajaxAddTemplate.phpwith shell metacharacters in thefileNameparameter. - Audit all network device credentials stored in rConfig and rotate them immediately, as an attacker who exploited this vulnerability may have exfiltrated stored device credentials. Consider implementing credential vaulting with just-in-time access to reduce the impact of future compromises.
Technical Details
CVE-2020-10221 is an OS command injection vulnerability in rConfig through version 3.9.4, specifically in the file lib/ajaxHandlers/ajaxAddTemplate.php. The vulnerability exists because the fileName POST parameter is passed directly to an OS command without proper sanitization of shell metacharacters. When a user submits a template upload request, the application constructs a system command incorporating the filename value. By including shell metacharacters such as semicolons, pipes, or command substitution operators in the fileName parameter, an authenticated attacker can append arbitrary commands that execute with the privileges of the web server process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-based exploitation with low complexity and low privilege requirements, resulting in complete compromise of confidentiality, integrity, and availability on the rConfig server.
Frequently Asked Questions
Is CVE-2020-10221 being actively exploited?
Yes. CVE-2020-10221 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is freely available, and the EPSS score of 91.39% (99.66th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2020-10221?
CVE-2020-10221 affects rConfig through version 3.9.4. The vulnerability is in the lib/ajaxHandlers/ajaxAddTemplate.php file and impacts any deployment of rConfig running version 3.9.4 or earlier that exposes the web interface.
How do I fix CVE-2020-10221?
Upgrade rConfig to a version newer than 3.9.4. If immediate patching is not possible, restrict network access to the rConfig web interface, implement WAF rules to block command injection patterns, and rotate all network device credentials stored in rConfig.
How severe is CVE-2020-10221?
CVE-2020-10221 has a CVSS 3.1 score of 8.8 (HIGH) and an EPSS score at the 99.66th percentile, indicating near-certain exploitation. The vulnerability allows authenticated remote code execution on the rConfig server, which could lead to compromise of all managed network devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.