Multiple vulnerabilities in RhinOS from SaltOS
Posted date 27/05/2024
Importance
5 - Critical
Affected Resources
RhinOS, version 3.0-1190.
Description
INCIBE has coordinated the publication of 3 vulnerabilities of different severities, affecting SaltOS RhinOS, version 3.0-1190, a cloud computing solution for business management that integrates CRM and ERP functionalities, which have been discovered by Rafael Pedrero.
These vulnerabilities have been assigned the following codes, CVSS v3.1 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2024-5407: 10 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | CWE-94.
- CVE-2024-5408: 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | CWE-79.
- CVE-2024-5409: 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L | CWE-79.
Solution
The manufacturer recommends upgrading RhinOS to the most recent version.
Detail
- CVE-2023-5407: a vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure.
- CVE-2024-5408: vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL.
- CVE-2024-5409: RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details.
References list
