CVE-2020-8655
EyesOfNetwork Improper Privilege Management Vulnerability
Description
CVE-2020-8655 is a HIGH improper privilege management vulnerability in EyesOfNetwork 5.3 with a CVSS 3.1 score of 7.8. The sudoers configuration is insecure, allowing the apache user to run arbitrary commands as root by crafting a malicious Nmap Scripting Engine (NSE) script and executing it through nmap 7. This vulnerability enables local privilege escalation from the web server user to full root access. Affected products include EyesOfNetwork version 5.3-0. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.88073 (99.482nd percentile) indicates very high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| eyesofnetwork | eyesofnetwork | 5.3-0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/EyesOfNetworkCommunity/eonconf/issues/8(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8655(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2020-8655 is classified under CWE-269 — Improper Privilege Management. This weakness occurs when software does not properly assign, modify, track, or check privileges for an actor, allowing attackers to gain unintended levels of access. Privilege management failures often result in vertical privilege escalation, where a lower-privileged user gains higher-level access.
In the context of EyesOfNetwork, the sudoers configuration grants the apache user (which runs the web application) the ability to execute nmap with root privileges. Since nmap supports the Nmap Scripting Engine (NSE) which can execute arbitrary Lua scripts, an attacker who can control the apache user can craft a malicious NSE script that executes system commands as root. This is a classic example of overly permissive sudoers rules combined with a program that supports arbitrary script execution, creating a straightforward privilege escalation path.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2020-8655 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Once root access is obtained, the attacker has unrestricted access to all data on the system, including application databases, configuration files with credentials, SSH keys, and any sensitive data stored on or accessible from the EyesOfNetwork server.
Integrity (HIGH): With root privileges, attackers can modify any file on the system, install persistent rootkits, alter system binaries, manipulate monitoring data, and establish hidden backdoor access that survives system reboots.
Availability (HIGH): Complete system disruption is possible with root access, including shutting down services, destroying data, encrypting the filesystem, or using the server as a platform for attacks against other infrastructure.
Context: This vulnerability is often chained with CVE-2020-8657 (hardcoded API key) and other EyesOfNetwork vulnerabilities to achieve a full remote-to-root exploitation chain. An attacker first gains remote access through the API vulnerability, then escalates to root using this privilege management flaw.
Exploit Maturity
CVE-2020-8655 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploit code is available, including entries in PacketStorm Security. The exploitation technique is well-documented: an attacker with apache user access writes a malicious NSE script and executes it via the sudo-permitted nmap command. The exploit is simple and reliable.
Ransomware association: No direct ransomware association has been confirmed for CVE-2020-8655 as of the latest KEV data. However, the root-level access achieved through exploitation could directly enable ransomware deployment on the compromised server.
Attack surface: This is a local privilege escalation vulnerability, meaning the attacker first needs access as the apache user. In practice, this is commonly achieved by chaining with CVE-2020-8657 or other remote access vulnerabilities. The EPSS score of 0.88073 (99.482nd percentile) reflects significant exploitation activity.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Update EyesOfNetwork immediately. Apply updates per vendor instructions to receive a corrected sudoers configuration. Check the GitHub issue for specific guidance.
- Fix the sudoers configuration. Remove or restrict the apache user's sudo access to nmap. If nmap must run with elevated privileges, configure sudoers to only allow specific nmap commands without script execution capabilities (disallow the --script parameter).
- Implement the principle of least privilege. Review all sudoers entries on the EyesOfNetwork server and remove any unnecessary privilege escalation paths. The web application user should have minimal system-level access.
- Deploy application-level controls. If the EyesOfNetwork web interface provides nmap scanning functionality, ensure that user-controlled input cannot influence NSE script paths or content.
- Monitor for privilege escalation attempts. Configure auditd or similar logging to detect sudo usage by the apache user, especially nmap executions with custom script parameters.
- Address related vulnerabilities. Ensure CVE-2020-8657 (hardcoded API key) is also remediated, as these vulnerabilities are commonly chained for full remote root compromise.
Technical Details
CVE-2020-8655 is a HIGH-severity local privilege escalation vulnerability in EyesOfNetwork. While the attack vector is local, user interaction is required in the default CVSS scoring.
Technical mechanism: The EyesOfNetwork 5.3 installation configures sudoers to allow the apache user to execute nmap 7 with root privileges. This is intended to support network discovery features in the monitoring platform. However, nmap includes the Nmap Scripting Engine (NSE) which can execute arbitrary Lua scripts. By crafting a malicious NSE script, the apache user can execute arbitrary commands as root through the permitted sudo nmap invocation.
Exploitation flow: An attacker who has gained access as the apache user (commonly through CVE-2020-8657 or another web-level vulnerability) writes a Lua script containing OS commands (e.g., os.execute or io.popen calls). The attacker then invokes nmap with sudo and specifies the malicious NSE script via the --script parameter. Nmap executes with root privileges and runs the attacker's script, providing root-level command execution.
CVSS 3.1 vector analysis (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): Local attack vector, low complexity, no prior privileges needed within the EyesOfNetwork context, user interaction required. The Unchanged scope means impact is confined to the compromised system.
Affected products: EyesOfNetwork (5.3-0).
Frequently Asked Questions
Is CVE-2020-8655 being actively exploited?
Yes, CVE-2020-8655 is actively exploited and listed in CISA's KEV catalog. It is commonly chained with CVE-2020-8657 (hardcoded API key) to achieve full remote-to-root compromise of EyesOfNetwork systems. The EPSS score of 0.88073 (99.482nd percentile) confirms very high exploitation activity.
What products are affected by CVE-2020-8655?
EyesOfNetwork version 5.3-0 is confirmed affected. The vulnerability is in the sudoers configuration that ships with the product, granting the apache web server user overly permissive sudo access to nmap with root privileges.
How do I fix CVE-2020-8655?
Update EyesOfNetwork to a corrected version. If immediate updating is not possible, modify the sudoers configuration to remove or restrict the apache user's ability to run nmap with root privileges. Specifically, prevent execution with the --script parameter. Also address CVE-2020-8657 to prevent the initial remote access vector.
How severe is CVE-2020-8655?
CVE-2020-8655 is rated HIGH with a CVSS score of 7.8. While it requires local access (typically gained through CVE-2020-8657), it provides root-level privilege escalation. Combined with the hardcoded API key vulnerability, it creates a complete remote-to-root attack chain. The EPSS score of 0.88073 (99.482nd percentile) reflects significant real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.