CA IDENTITY GOVERNANCE: Potential Command Injection

Products

• CA Identity Suite

Issue/Introduction

Command injection vulnerabilities occur when user-provided input is used to construct and execute system commands without proper validation or sanitization. This allows attackers to inject malicious commands into the application, potentially resulting in arbitrary command execution on the underlying system. If the application is running with elevated privileges, a successful command injection exploit can lead to the full compromise of the system.

Specific Description

The Penetration Testers identified a function located at: https://liam-at.lfnet.se/eurekify/portal/?wicket:interface=:191:1::: This function may be vulnerable to command injection, as it processes user-provided input to construct system commands. However, Truesec was unable to fully validate the exploitation of this vulnerability. While attempts were made to execute commands, the lack of access to server-side logs prevented confirmation of whether the commands were successfully executed. As such, this finding should be treated as a potential vulnerability requiring further investigation

Environment

IDM 14.5.1 CHF1

Resolution

As part of our penetration testing activities, we have covered various areas, including but not limited to the following:

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Cookie Security
• Command Injection
• Code Injection
• CSS Injection
• Input Validation
• JSON Injection

If we identify any vulnerabilities related to specific use cases, please raise a support, and we will investigate further.

In regard to the Principle of Least Privilege, please note that IG provides Role Management capabilities to ensure access control is managed by administrators.