CVE-2018-11061 Explained : Impact and Mitigation

Versions of RSA NetWitness Platform older than 11.1.0.2 and RSA Security Analytics versions older than 10.6.6 have a vulnerability that allows a server-side template injection attack. This vulnerability is caused by the insecure setup of the template engine implemented in the product. A malicious remote user who has been authenticated on the RSA NetWitness Server and possesses either an Admin or Operator role can take advantage of this vulnerability to execute arbitrary commands on the server, granting them root privileges.

Understanding CVE-2018-11061

This CVE identifies a server-side template injection vulnerability in RSA NetWitness Platform and RSA Security Analytics.

What is CVE-2018-11061?

CVE-2018-11061 is a critical vulnerability in RSA NetWitness Platform and RSA Security Analytics that allows authenticated remote attackers to execute arbitrary commands on the server with root privileges.

The Impact of CVE-2018-11061

The impact of this vulnerability is critical, with a CVSS base score of 9.1. Attackers can exploit this flaw to compromise the confidentiality, integrity, and availability of the affected systems.

Technical Details of CVE-2018-11061

This section provides technical details about the vulnerability.

Vulnerability Description

The vulnerability is a server-side template injection issue resulting from the insecure configuration of the template engine in RSA NetWitness Platform and RSA Security Analytics.

Affected Systems and Versions

RSA NetWitness Platform versions prior to 11.1.0.2
RSA Security Analytics versions prior to 10.6.6

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: High
User Interaction: None
Scope: Changed
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Mitigation and Prevention

Protecting systems from CVE-2018-11061 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply vendor-supplied patches promptly.
Monitor network traffic for signs of exploitation.
Restrict access to vulnerable systems.

Long-Term Security Practices

Regularly update and patch all software and systems.
Conduct security training for users to recognize phishing attempts.
Implement network segmentation to limit the impact of potential breaches.
Employ strong authentication mechanisms.

Patching and Updates

Ensure that RSA NetWitness Platform is updated to version 11.1.0.2 or later, and RSA Security Analytics is updated to version 10.6.6 or above.