Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2021-42855

Local privilege escalation due to misconfigured write permission on .debug_command.config file

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GovTech CSG

Description

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Aternity SteelCentral AppInternals Dynamic Sampling Agent

  • 10.xaffected
  • 12.13.0 to < 12.13.0affected
  • 11.8.8 to < 11.8.8affected

References