CVE-2021-22502
Micro Focus Operation Bridge Report (OBR) Remote Code Execution Vulnerability
Description
CVE-2021-22502 is a critical remote code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) version 10.40 with a CVSS score of 9.8. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the OBR server through an OS command injection flaw. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable from the network. With an EPSS score of 0.938 (99.9th percentile), public exploit code is readily available, and the vulnerability has been acknowledged by the Zero Day Initiative (ZDI-21-153 and ZDI-21-154). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microfocus | operation bridge reporter | 10.40 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162408/Micro-Focus-Operations-Bridge-Reporter-Unauthenticated-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://softwaresupport.softwaregrp.com/doc/KM03775947(Vendor Advisory)
- https://www.zerodayinitiative.com/advisories/ZDI-21-153/(Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-21-154/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22502(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-78 occurs when an application constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2021-22502, Micro Focus Operation Bridge Reporter fails to properly sanitize user input before incorporating it into OS commands, allowing attackers to inject and execute arbitrary system commands on the server.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
The impact of CVE-2021-22502 is critical, with a CVSS score of 9.8 and the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication or user interaction, and achieves High impact across all three dimensions: confidentiality, integrity, and availability. Successful exploitation grants the attacker the ability to execute arbitrary OS commands on the OBR server, potentially with the privileges of the service account running OBR. This can lead to complete system compromise, data exfiltration, installation of persistent backdoors, lateral movement to other systems on the network, and disruption of monitoring and reporting operations that depend on OBR.
Exploit Maturity
CVE-2021-22502 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on November 3, 2021. The EPSS score of 0.938 (99.9th percentile) indicates an extremely high exploitation probability. Public exploit code is available on Packet Storm Security, and the vulnerability was reported through the Zero Day Initiative program (ZDI-21-153 and ZDI-21-154), with detailed technical advisories published. The combination of unauthenticated access, remote exploitability, and publicly available exploit code makes this vulnerability highly attractive to threat actors.
Remediation
- Apply the vendor patch from Micro Focus (now OpenText) as documented in KM03775947 immediately to address the command injection vulnerability in Operation Bridge Reporter.
- Restrict network access to the OBR server by implementing firewall rules that limit connectivity to authorized management stations and data sources only.
- Monitor for indicators of compromise by reviewing OBR server logs, system process lists, and network connections for signs of unauthorized command execution or suspicious outbound traffic.
- Implement web application firewall rules to detect and block common OS command injection patterns in requests to the OBR web interface.
- Run OBR with minimal privileges by ensuring the service account used by OBR has only the minimum necessary permissions, limiting the impact of successful command injection.
- Conduct a full compromise assessment on any OBR servers that were running version 10.40 while exposed to untrusted networks, checking for backdoors, unauthorized accounts, and data exfiltration.
Technical Details
The vulnerability is an OS command injection flaw in Micro Focus Operation Bridge Reporter version 10.40. OBR is a reporting and analytics platform used for IT operations management and performance monitoring. The application accepts user input through its web interface and incorporates this input into operating system commands executed on the server without proper sanitization or escaping of shell metacharacters. An unauthenticated attacker can craft specially designed HTTP requests that include OS command injection payloads, which are then executed by the server in the context of the OBR service. The Zero Day Initiative advisories (ZDI-21-153 and ZDI-21-154) document multiple injection points within the application. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms that the attack is network-accessible, requires no privileges or user interaction, and has low complexity. The availability of public exploit code on Packet Storm Security demonstrates a complete attack chain from unauthenticated access to arbitrary command execution.
Frequently Asked Questions
Is CVE-2021-22502 being actively exploited?
Yes. CVE-2021-22502 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available, and the EPSS score of 0.938 (99.9th percentile) indicates extremely high exploitation activity. The vulnerability was disclosed through the Zero Day Initiative program with detailed technical advisories.
What products are affected by CVE-2021-22502?
Micro Focus Operation Bridge Reporter (OBR) version 10.40 is affected. OBR is a reporting and analytics platform for IT operations management used in enterprise environments.
How do I fix CVE-2021-22502?
Apply the vendor patch documented in Micro Focus advisory KM03775947. Restrict network access to the OBR server, implement web application firewall rules to block command injection attempts, and conduct a compromise assessment on any exposed instances.
How severe is CVE-2021-22502?
With a CVSS score of 9.8 (Critical), CVE-2021-22502 is extremely severe. It allows unauthenticated remote attackers to execute arbitrary OS commands on the OBR server with no user interaction required. The availability of public exploits and the near-maximum EPSS score make this one of the most actively targeted vulnerabilities in the Micro Focus product line.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.