Mutare Security Advisory

Advisory ID MUTARE-2021-001
Severity Critical
CVE CVE-2021-27236
Published Date February 5, 2021
Revision Date February 16, 2021

Overview

Unauthenticated Local File Inclusion to Remote Code Execution

Affected Products/Versions

Mutare Voice (EVM), Versions Affected 3.0.0-3.3.7

Vulnerability Details

The Mutare Voice (EVM) web application suffers from unauthenticated local file inclusion which leads to source code disclosure and provides an ability to dump server-side files alongside with possibility to escalate the chain to Remote Code Execution providing complete control over the server.

The getfile.asp script file can be utilized to view file contents via a parameter. This can be used to leak the source of the file. This can subsequently be used to escalate to a Remote Code Execution.

Workarounds

The getfile.asp file can be removed from the application. It is used for streaming voice files for playback via browser.

Solution

Upgrading Mutare Voice (EVM) to release 3.3.8 fixes the vulnerability.

References

Acknowledgements

Mutare would like to thank Tesla for reporting this issue and working with Mutare to help protect our customers.