CVE-2018-11138: Quest KACE System Management Appliance Remote Command Execution Vulnerability

How it works

CVE-2018-11138 is a remote command execution flaw in the Quest KACE System Management Appliance. It stems from CWE-78 (OS command injection). According to the CISA summary, the script at /common/download_agent_installer.php is reachable by anonymous users and can be abused to run commands on the appliance.

In this class of weakness, user-controlled input reaches a shell or similar interpreter without proper validation or escaping. An unauthenticated attacker who can reach the script can supply crafted input that the appliance treats as part of an operating-system command. Successful abuse gives the attacker the ability to execute arbitrary commands in the context of the vulnerable service. Exact parameter names, payloads, and preconditions are not detailed here; confirm those against the vendor advisory.

Am I affected? How to find it in your systems

Quest KACE System Management Appliance (also known as KACE SMA) is typically deployed as a network appliance or virtual appliance used for endpoint inventory, software distribution, and related systems-management tasks. It often sits on management or internal networks and may be reachable from broader segments if access controls are loose.

Inventory steps:

• Search asset-management, CMDB, and vulnerability-scan data for Quest KACE / KACE SMA hosts and appliances.
• Identify web interfaces and management ports associated with KACE; look specifically for the path /common/download_agent_installer.php on any exposed HTTP/HTTPS listeners.
• Confirm the exact product build and patch level against the vendor advisory; public detail in this record does not list version ranges, so treat any unpatched KACE SMA instance as potentially in scope until verified.
• Review network diagrams and firewall rules for any path that allows unauthenticated access to the appliance web UI from untrusted or semi-trusted networks.

Telemetry and log signs of exploitation (general for this class): unexpected requests to /common/download_agent_installer.php, especially from external or unusual internal sources; command-shell or process-creation events spawned by the web service account; sudden outbound connections or new local accounts following such requests. Correlate web-access logs with host-based process and network logs. Absence of these signs does not prove safety if the appliance was reachable and unpatched.

How to remediate

Patch first. CISA’s required action is to apply updates per vendor instructions. Obtain the fixed release or patch package from Quest for the KACE System Management Appliance, validate it in a test environment if possible, then deploy it to production appliances and verify the build string afterward.

After patching, harden for this weakness class:

• Ensure the management interface is not exposed to the internet or to broad internal networks; restrict it to dedicated admin jump hosts or management VLANs.
• Enforce strong authentication and, where supported, multi-factor authentication on all KACE administrative access.
• Disable or remove any unused agent-download or installer features if the product configuration allows it and business needs permit.
• Run the appliance service under least privilege and keep the underlying OS and dependencies current per vendor guidance.
• Re-scan with an authenticated vulnerability scanner and confirm the specific script is no longer reachable anonymously or no longer accepts unsafe input.

If you can't patch immediately

Until the vendor update is applied, reduce exposure with compensating controls:

• Network segmentation: place the appliance behind a firewall or ACL that permits access only from a small set of trusted administrative hosts; block anonymous or general-user reachability to the web UI, especially the /common/ path.
• Virtual patching / WAF: if a web application firewall or reverse proxy sits in front of the appliance, add a rule to block or tightly constrain requests to /common/download_agent_installer.php and to reject unexpected parameters or shell metacharacters. Tune and monitor for false positives.
• Feature disablement: if the product allows disabling the agent-installer download function or anonymous access to it, turn that capability off until patched.
• Heightened monitoring: alert on any hit to the vulnerable script, on process execution by the web service account, and on anomalous outbound traffic from the appliance. Retain logs for forensic review.
• Credential and session hygiene: rotate administrative credentials for the appliance and review recent configuration changes.

These measures lower risk but do not replace the vendor patch. Schedule the update as soon as practicable.

If your data may have been exposed

This vulnerability has known ransomware use. Actively exploited remote-command-execution flaws on management appliances frequently lead to full compromise, lateral movement, data theft, or ransomware deployment. If your KACE SMA was reachable and unpatched during the period of exposure, treat it as a potential incident: isolate the host, preserve logs and disk images, hunt for persistence and follow-on activity, and follow your incident-response plan. As a further check, you can run a free exposure scan of your email addresses against known breach data to see whether associated credentials or identities have appeared in public breach corpora.