Vulnerability record · CVE-2018-7739 · published 7 March 2018
CVE-2018-7739: antsle antman authentication bypass via invalid login characters
Antsle · Antman
antsle antman before 0.9.1a fails to validate the username and password parameters on the /login URI, allowing crafted input such as username=>&password=%0a to bypass authentication. Because the login process passes this input to Java's ProcessBuilder and the antsle-auth bash script, the flaw grants root access in the web management console.
Description
antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI. This allows obtaining root permissions within the web management console, because the login process uses Java's ProcessBuilder class and a bash script called antsle-auth with insufficient input validation.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and a very high EPSS score make this an urgent pre-auth root compromise risk.
What it is
antsle antman before 0.9.1a fails to validate the username and password parameters on the /login URI, allowing crafted input such as username=>&password=%0a to bypass authentication. Because the login process passes this input to Java's ProcessBuilder and the antsle-auth bash script, the flaw grants root access in the web management console.
Impact
An unauthenticated attacker gains root permissions within the antman web management console, giving full control over the managed host and its configuration.
Attack surface
Reachable over the network through the /login URI of the antman web console; no authentication or user interaction is required, as reflected by the CVSS vector AV:N/PR:N/UI:N.
Exploitation
Public exploit code exists (Exploit-DB 44220 and 44262, plus a third-party advisory blog), and EPSS is 0.53231 (98.9th percentile), though the CVE is not listed in CISA KEV.
What to do
- Upgrade antman to 0.9.1a or later, which fixes the input validation flaw.
- If immediate upgrade is not possible, restrict network access to the antman web console to trusted management networks only.
- Review and harden the antsle-auth script and login flow to avoid passing user input to ProcessBuilder or shell commands.
- Audit the antman console for unauthorized accounts or configuration changes made through the bypass.
Detection
- Monitor web server and antman logs for /login requests containing shell metacharacters or newline sequences in username or password parameters.
- Alert on successful logins from unexpected source IPs or at unusual times, especially followed by root-level console actions.
- Inspect process execution logs for antsle-auth invocations with abnormal arguments or child processes spawned from the web console.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.html | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/44220/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/44262/ | ExploitThird Party AdvisoryVDB Entry |
| http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.html | ExploitThird Party Advisory |
| https://www.exploit-db.com/exploits/44220/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.exploit-db.com/exploits/44262/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-7739 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-7739), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
