Exagate Sysguard 6001 - 跨站请求伪造 (添加管理员)

The primary impact of this XSRF vulnerability is the unauthorized creation of administrative accounts. An attacker could craft a malicious HTML form, hosted on a different domain, and entice a legitimate user of Exagate SYSGuard 6001 to submit it. Upon submission, the attacker gains the ability to create a new user account with administrative privileges, effectively compromising the system. This could lead to complete control over the SYSGuard instance, including data access, configuration changes, and potentially lateral movement within the network if SYSGuard has access to other resources. The blast radius extends to any data managed by the SYSGuard system, and the attacker could leverage the administrative account to install malware or further compromise the environment.

Organizations utilizing Exagate SYSGuard 6001 version 6001–6001 are at risk, particularly those with users who frequently interact with the system's administrative interface. Shared hosting environments where multiple users share the same SYSGuard instance are also at heightened risk, as an attacker could potentially target any user to gain administrative access.

• php / web:

curl -X POST -d "param1=value1&admin=true" https://target/kulyon.php 2>&1 | grep -i "user created"

• generic web:

curl -I https://target/kulyon.php | grep -i "content-type: application/x-www-form-urlencoded"

1. 已保留2026-02-03
2. 发布日期2026-02-05
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-23

The recommended mitigation for CVE-2020-37144 is to upgrade to a patched version of Exagate SYSGuard 6001 when available. In the absence of a patch, implementing a Web Application Firewall (WAF) with XSRF protection rules is crucial. These rules should validate the origin of requests to /kulyon.php and reject those originating from untrusted domains. Additionally, consider implementing stricter input validation and output encoding on the /kulyon.php endpoint to prevent malicious data from being processed. After implementing WAF rules, verify their effectiveness by attempting to submit a crafted XSRF request and confirming that it is blocked.