Inspur Clusterengine Remote Code Execution Scanner

Inspur Clusterengine is widely used by enterprises and organizations to manage clusters and high-performance computing environments efficiently. It is used by system administrators and IT professionals to streamline resource allocation and workload management. The software supports critical applications across industries, enabling scalable parallel processing. Clusterengine simplifies complex configurations and optimizes performance, making it a preferred choice for large-scale deployments. It integrates with various tools and platforms for enhanced functionality, ensuring seamless operations. Organizations rely on it to maintain high availability and fault tolerance in their computing clusters.

Remote Code Execution (RCE) is a serious vulnerability that allows attackers to execute arbitrary commands on a system. This type of vulnerability poses significant risks, as it can be exploited remotely without prior authentication. In the case of Inspur Clusterengine, SYSshell provides unintended command execution capabilities. This vulnerability could lead to a complete compromise of the affected system. Attackers could gain unauthorized access to sensitive data and disrupt operations. RCE vulnerabilities are critical due to their potential impact on system integrity and confidentiality.

The vulnerability in Inspur Clusterengine resides in the SYSshell endpoint, which is accessible over HTTP. A specific POST request can trigger command execution when certain parameters are manipulated. The 'command' parameter is a key vector, and improper handling leads to exploitation. The use of predictable commands such as 'cat+/etc/passwd' indicates system-level access. The vulnerability allows an attacker to retrieve sensitive information and gain further foothold in the system. Successful exploitation relies on crafting requests that bypass security mechanisms.

If exploited, this vulnerability can lead to system-level control by attackers. Unauthorized actions include data extraction, addition of new users, and configuration changes. Attackers can disrupt services by executing harmful scripts or deleting critical files. Data integrity might be compromised, leading to information theft and unauthorized modifications. Business operations depending on cluster services can face downtime and loss of service availability. The financial and reputational damage can be significant for targeted organizations.

REFERENCES

• https://www.inspursystems.com/
• https://github.com/MzzdToT/ClusterEngineV4.0sysShell_rce
• https://nvd.nist.gov/vuln/detail/CVE-2020-21224
• https://github.com/NS-Sp4ce/Inspur/tree/master/ClusterEngineV4.0%20Vul