#VU17394 Arbitrary file upload in Carousel - CVE-2018-18930

Vulnerability identifier: #VU17394

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-18930

CWE-ID: CWE-434

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Carousel
Web applications / Remote management & hosting panels

Vendor: Tightrope

Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to arbitrary file upload. A remote attacker can execute the reverse shell Powershell script via the web shell, upload arbitrary file and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation
Patch will be available on February 8.

Vulnerable software versions

Carousel: 7.0.0 - 7.0.4.104

---

External links
https://www.drewgreen.net/vulnerabilities-in-tightrope-media-systems-carousel/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.