CVE-2020-11016: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-04-30T23:15Z
Repository: https://github.com/certtools/intelmq-manager
Language: Markdown
Files changed: CHANGELOG.md, NEWS.md, intelmq-manager/php/controller.php
Commit date: 2020-04-27 21:46:57 +0200
Commit message: SEC: fix RCE bug in controller.php

@bernhard-herzog (@Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5840b56..2123238 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,14 +2,15 @@ CHANGELOG
 =========
 
 
 2.1.1 (unreleased)
 ------------------
-
+Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.
 
 ### Backend
 - Fix mispelling of the environmental variable `INTELMQ_MANGER_CONTROLLER_CMD` to `INTELMQ_MANAGER_CONTROLLER_CMD` (an 'a' was missing).
+- Fix handling of POST variable `msg` of the message-sending functionality available in the Inspect-tool.
 
 ### Pages
 
 #### Landing page
 
diff --git a/NEWS.md b/NEWS.md
index 3bb9b84..d80121a 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -3,10 +3,14 @@ NEWS
 
 See the changelog for a full list of changes.
 
 2.1.1 (unreleased)
 ------------------
+**Never ever run intelmq-manager on a public webserver without SSL and proper authentication**.
+
+Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.
+
 The environment variable name was corrected from `INTELMQ_MANGER_CONTROLLER_CMD` to `INTELMQ_MANGAER_CONTROLLER_CMD` you might need to adapt your configuration.
 The old name will be available until version 3.0.
 
 Use IntelMQ Manager only from a browser that can only access internal, trusted sites. (Because CSRF development is under way, see [#111](github.com/certtools/intelmq/issues/111)).
 
diff --git a/intelmq-manager/php/controller.php b/intelmq-manager/php/controller.php
index dcbfa3f..472c277 100644
--- a/intelmq-manager/php/controller.php
+++ b/intelmq-manager/php/controller.php
@@ -102,11 +102,11 @@ if ($scope == 'botnet') {
             break;
         case "pop":
             $arguments .= "message pop";
             break;
         case "send":
-            $arguments .= "message send '" . escapeshellarg(filter_input(INPUT_POST, "msg")) . "'";
+            $arguments .= "message send " . escapeshellarg(filter_input(INPUT_POST, "msg"));
             break;
         case "process":
             $arguments .= "process";
             if(filter_input(INPUT_GET, "show", FILTER_VALIDATE_BOOLEAN)) {
                 $arguments .= " --show-sent";

Vulnerable code: 
            $arguments .= "message send '" . escapeshellarg(filter_input(INPUT_POST, "msg")) . "'";
Fixed code: Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.
- Fix handling of POST variable `msg` of the message-sending functionality available in the Inspect-tool.
**Never ever run intelmq-manager on a public webserver without SSL and proper authentication**.

Bernhard Herzog (Intevation) discovered that the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.

            $arguments .= "message send " . escapeshellarg(filter_input(INPUT_POST, "msg"));