The administrative operations within the Carbon Console do not adequately validate specific user-supplied input

Overview

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.

Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Affected

• api_control_plane >= 4.5.0, < 4.5.0.36
• api_control_plane = 4.6.0
• api_manager >= 3.1.0, < 3.1.0.349
• api_manager >= 3.2.0, < 3.2.0.453
• api_manager >= 3.2.1, < 3.2.1.73
• api_manager >= 4.0.0, < 4.0.0.373
• api_manager >= 4.1.0, < 4.1.0.236
• api_manager >= 4.2.0, < 4.2.0.176
• api_manager >= 4.3.0, < 4.3.0.88
• api_manager >= 4.4.0, < 4.4.0.52
• api_manager >= 4.5.0, < 4.5.0.35
• api_manager = 4.6.0
• identity_server >= 5.10.0, < 5.10.0.378
• identity_server >= 5.11.0, < 5.11.0.425
• identity_server >= 6.0.0, < 6.0.0.252
• identity_server >= 6.1.0, < 6.1.0.253
• identity_server >= 7.0.0, < 7.0.0.130
• identity_server >= 7.1.0, < 7.1.0.38
• identity_server = 7.2.0
• identity_server_as_key_manager >= 5.10.0, < 5.10.0.369
• open_banking_am >= 2.0.0, < 2.0.0.398
• open_banking_iam >= 2.0.0, < 2.0.0.418
• traffic_manager >= 4.5.0, < 4.5.0.34
• traffic_manager = 4.6.0
• universal_gateway >= 4.5.0, < 4.5.0.34
• universal_gateway = 4.6.0

Remediation

Upgrade past the affected range:

• api_control_plane 4.5.0.36
• api_manager 4.5.0.35
• identity_server 7.1.0.38
• identity_server_as_key_manager 5.10.0.369
• open_banking_am 2.0.0.398
• open_banking_iam 2.0.0.418
• traffic_manager 4.5.0.34
• universal_gateway 4.5.0.34