Nokia BMC Log Scanner – Remote Code Execution

• Exploit Database
• 14 阅读

• 作者： Carlos Andres Gonzalez, Matthew Gregory
  日期： 2024-03-16
• 类别：

  • webapps
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/51896/

• # Exploit Title: Nokia BMC Log Scanner Remote Code Execution
  # Google Dork: N/A
  # Date: November 29, 2023
  # Exploit Author: Carlos Andres Gonzalez, Matthew Gregory
  # Vendor Homepage: https://www.nokia.com/
  # Software Link: N/A
  # Version: 13
  # Tested on: Linux
  # CVE : CVE-2022-45899
  
  Description
  The BMC Log Scanner web application, available on several hosts, is vulnerable to command injection
  attacks, allowing for unauthenticated remote code execution. This vulnerability is especially significant
  because this service runs as root.
  
  Steps to Reproduce:
  In the Search Pattern field, type:
  
  ;";command
  
  Replacing the word "command" above with any Linux command.
  Root access can be confirmed with the id command or any other command that would require
  root access, such as displaying the contents of the /etc/shadow file."
  
  This issue was fixed in version 13.1.