CVE-2021-32961 Explained : Impact and Mitigation

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and gain execution capabilities.

Understanding CVE-2021-32961

This vulnerability was reported by Amir Preminger of Claroty Research to MDT Software, affecting MDT AutoSave and AutoSave for System Platform (A4SP).

What is CVE-2021-32961?

CVE-2021-32961 is an unrestricted upload of file with a dangerous type vulnerability in MDT AutoSave, allowing an attacker to execute arbitrary commands.

The Impact of CVE-2021-32961

With a CVSS base score of 7.5 (High severity), this vulnerability can lead to the execution of malicious code and compromise system integrity.

Technical Details of CVE-2021-32961

This vulnerability has a low attack complexity, requires no special privileges, and can be exploited over a network.

Vulnerability Description

The vulnerability allows an attacker to utilize a specific function to upload and execute malicious files in affected versions of MDT AutoSave and A4SP.

Affected Systems and Versions

MDT AutoSave versions prior to v6.02.06
MDT AutoSave 7.00
AutoSave for System Platform (A4SP) prior to v4.01
A4SP version 5.00

Exploitation Mechanism

Exploitation involves supplying a specific optional parameter to exploit the getfile function and execute unauthorized commands.

Mitigation and Prevention

To address CVE-2021-32961, updated versions of MDT AutoSave and A4SP have been released by MDT Software.

Immediate Steps to Take

Update MDT AutoSave to version 6.02.06 or higher
Update MDT AutoSave 7.x to version 7.05
Update A4SP to version 4.01 or higher
Update A4SP 5.x to version 5.01

Long-Term Security Practices

Regularly update software, apply patches promptly, and monitor for any unusual file uploads or executions.

Patching and Updates

For more information on the vulnerabilities and to install the new versions, contact MDT Software customer support.