Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
Description: CAPEC-108 Command Line Execution through SQL Injection
Solutions
The recommended resolution is to upgrade to the version indicated below and apply the hotfix at your earliest convenience.
* 17.1 Upgrade
* 17.0 (requires Hotfix)
To resolve click the following link for instructions to either upgrading or apply a hotfix patch:
Click here for the hotfix and instructions on resolving this issue https://wiki.edge.arista.com/index.php/Patch_-_Report_vulnerability
Configurations
If the NGFW has one or more Report application Report Users with Online Access enabled they are vulnerable.
Workarounds
For the Reports application, for all Reports Users, disable Online Access.
To do this:
2. As the NGFW administrator, log into the UI and go to the Reports application.
3. For all users with the Online Access checkbox (red box) enabled, uncheck it.
4. Click Save.
Exploits
Arista is not aware of any exploitation of this vulnerability in customer networks.
Credits
finder
Arista would like to acknowledge and thank Gereon Huppertz, working with Trend Micro's Zero Day Initiative for responsibly reporting CVE-2024-27889