CVE-2020-35710 (GCVE-0-2020-35710)
Vulnerability from cvelistv5
Published
2020-12-25 18:58
Modified
2024-08-04 17:09
Severity ?
CWE
  • n/a
Summary
Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker's client for use as a "host" value. In other words, after an attacker's web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like "host":"192.168.###.###" in the POST data.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:09:15.165Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/amadapa/status/1342407005110218753"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker\u0027s client for use as a \"host\" value. In other words, after an attacker\u0027s web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like \"host\":\"192.168.###.###\" in the POST data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-25T20:07:26",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/amadapa/status/1342407005110218753"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-35710",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker\u0027s client for use as a \"host\" value. In other words, after an attacker\u0027s web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like \"host\":\"192.168.###.###\" in the POST data."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html",
              "refsource": "MISC",
              "url": "https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html"
            },
            {
              "name": "https://twitter.com/amadapa/status/1342407005110218753",
              "refsource": "MISC",
              "url": "https://twitter.com/amadapa/status/1342407005110218753"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-35710",
    "datePublished": "2020-12-25T18:58:04",
    "dateReserved": "2020-12-25T00:00:00",
    "dateUpdated": "2024-08-04T17:09:15.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-35710\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-12-25T19:15:13.177\",\"lastModified\":\"2024-11-21T05:27:53.670\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank credentials) provides this address to the attacker\u0027s client for use as a \\\"host\\\" value. In other words, after an attacker\u0027s web browser sent a request to the login form, it would automatically send a second request to a RASHTML5Gateway/socket.io URI with something like \\\"host\\\":\\\"192.168.###.###\\\" in the POST data.\"},{\"lang\":\"es\",\"value\":\"Parallels Remote Application Server (RAS) versi\u00f3n 18, permite a atacantes remotos detectar una direcci\u00f3n IP de intranet porque el env\u00edo del formulario de inicio de sesi\u00f3n (inclusive con credenciales en blanco) proporciona esta direcci\u00f3n al cliente del atacante para usarla como valor de \\\"host\\\".\u0026#xa0;En otras palabras, despu\u00e9s de que el navegador web de un atacante envi\u00f3 una petici\u00f3n hacia el formulario de inicio de sesi\u00f3n, podr\u00eda autom\u00e1ticamente enviar una segunda petici\u00f3n hacia un URI RASHTML5Gateway/socket.io con algo como \\\"host\\\":\\\"192.168.###.###\\\" en los datos POST\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:parallels:remote_application_server:18.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B246B73-F911-4579-A091-D92584323B04\"}]}]}],\"references\":[{\"url\":\"https://twitter.com/amadapa/status/1342407005110218753\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/amadapa/status/1342407005110218753\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.elladodelmal.com/2020/12/blue-team-red-team-como-parallels-ras.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.