Ilevia EVE X1 Server OS Command Injection Vulnerability Allowing Arbitrary Code Execution

An OS command injection vulnerability has been identified in Ilevia EVE X1 Server firmware versions through 4.7.18.0.eden. The vulnerability resides in the 'mbus_build_from_csv.php' file, where an unauthenticated attacker can execute arbitrary code by injecting commands through specific HTTP POST parameters. Ilevia has advised customers not to expose port 8080 to the internet.

Impact

Exploitation of this vulnerability allows for unauthorized execution of arbitrary commands on the server, potentially leading to unauthorized access or control over the system.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/ajax/php/mbus_build_from_csv.php' endpoint. The 'mbus_file' and 'mbus_csv' parameters can be used to inject and execute arbitrary shell commands. This can be done using tools like curl or Postman, or through a custom script that automates the process.