CVE-2020-4427
CRITICAL KEV NUCLEIIBM Data Risk Manager 2.0.1-2.0.6 - Authentication Bypass via SAML Misconfiguration
Title source: llmExploitation Summary
CVE-2020-4427 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 2 public exploits, including a Metasploit module exploits/linux/http/ibm_drm_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a chain of vulnerabilities in IBM Data Risk Manager (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) to achieve unauthenticated remote code execution as root. It bypasses authentication, injects commands, and abuses an insecure default password.
Description
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.
Exploits (2)
This Metasploit module exploits a chain of vulnerabilities in IBM Data Risk Manager (CVE-2020-4427, CVE-2020-4428, CVE-2020-4429) to achieve unauthenticated remote code execution as root. It bypasses authentication, injects commands, and abuses an insecure default password.
This Metasploit module exploits an authentication bypass (CVE-2020-4427) and path traversal vulnerability in IBM Data Risk Manager to download arbitrary files. It chains multiple steps to obtain admin credentials and fetch sensitive files like application.properties.
Nuclei Templates (1)
title:"IBM Data Risk Manager"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H