{
  "Name": "IBM Spectrum Protect Plus username rce",
  "Description": "IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175024.",
  "Product": "IBM Spectrum Protect Plus",
  "Homepage": "https://www.ibm.com/us-en/marketplace/ibm-spectrum-protect-plus",
  "DisclosureDate": "2020-02-24",
  "Author": "mahui@gobies.org",
  "FofaQuery": "title=\"IBM Spectrum Protect Plus\" ",
  "Level": "3",
  "Impact": "<p>IBM Spectrum Protect（前称Tivoli Storage Manager）和IBM Spectrum Protect Plus都是美国IBM公司的产品。该产品是一套数据保护平台。该平台为企业提供单一控制和管理点，并支持对所有规模的虚拟、物理和云环境进行备份和恢复。&nbsp;</p><p>IBM Spectrum Protect Plus 10.1.0版本至10.1.5版本中存在命令注入漏洞，源于在解析username参数的时候，将用户提交的字符串用于执行系统调用之前，未能妥当地验证用户提交的输入。如成功利用该漏洞，远程攻击者可在管理员的上下文中执行任意代码。<br></p>",
  "Recommandation": "<p>目前厂商已经发布修补补丁，可去厂商官网下载修复补丁安装或升级到最新版本:<a href=\"https://www.ibm.com/support/pages/node/3178863\" rel=\"nofollow\">https://www.ibm.com/support/pages/node/3178863</a></p>",
  "References": [
    "https://exchange.xforce.ibmcloud.com/vulnerabilities/175024",
    "https://www.ibm.com/support/pages/node/3178863",
    "https://www.zerodayinitiative.com/advisories/ZDI-20-270/",
    "https://nvd.nist.gov/vuln/detail/CVE-2020-4213",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4213"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "Name": "AttackType",
      "Type": "select",
      "Value": "goby_shell_linux"
    }],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "",
        "data_type": "text",
        "follow_redirect": true,
        "method": "GET",
        "uri": "/"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": null,
  "Tags": ["rce"], 
  "CVEIDs": [
    "CVE-2020-4213"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": ["IBM-Spectrum-Protect-Plus"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}