CVE-2020-17505: Artica Web Proxy authenticated command injection in cyrus.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote authenticated command injection yielding root, with public exploit code and a very high EPSS score, though it is not in CISA KEV.

What it is

Artica Web Proxy 4.30.000000 lets an authenticated remote attacker inject operating system commands through the service-cmds parameter in cyrus.php. The injected commands are executed with root privileges via service_cmds_peform, so a low-privileged account can take full control of the host. The flaw is a classic OS command injection (CWE-78).

Impact

An attacker with a valid account gains arbitrary command execution as root, leading to full compromise of the proxy host, including data theft, persistence and lateral movement.

Attack surface

Reachable over the network through the cyrus.php endpoint by supplying crafted input in the service-cmds parameter. Authentication is required (PR:L) and no user interaction is needed (UI:N).

Exploitation

No CISA KEV listing, but public exploit write-ups exist (Packet Storm and a third-party blog tagged Exploit), and EPSS is very high at 0.82 (99.6th percentile), indicating likely active exploitation attempts.

What to do

• Upgrade Artica Web Proxy to a version later than 4.30.000000 that fixes the command injection; if no fixed release is available, isolate the product.
• Restrict network access to the Artica management interface to trusted administrative networks only.
• Enforce least privilege and strong unique credentials for all Artica accounts, and remove unused accounts.
• Monitor and block suspicious characters or shell metacharacters in the service-cmds parameter at the web tier.
• If the product cannot be patched or isolated, consider replacing it or taking it offline.

Detection

• Inspect web server and proxy logs for requests to cyrus.php containing shell metacharacters or unexpected values in the service-cmds parameter.
• Alert on child processes spawned by the Artica web service, especially shells or commands running as root.
• Monitor for outbound connections or file writes originating from the Artica host that are inconsistent with normal proxy behavior.
• Correlate authentication events for Artica accounts with subsequent command execution activity on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.