Tom Elliott

4 exploits Active since Jul 2024
CVE-2024-39914 WRITEUP CRITICAL WRITEUP
fogproject < 1.5.10.34 - Command Injection via Filename Parameter
FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.
CVSS 9.8
CVE-2024-39916 WRITEUP MEDIUM WRITEUP
fogproject < 1.5.10 - Unauthenticated Arbitrary File Write via NFS no_subtree_check Option
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. There is a security issue with the NFS configuration in /etc/exports generated by the installer that allows an attacker to modify files outside the export in the default installation. The exports have the no_subtree_check option. The no_subtree_check option means that if a client performs a file operation, the server will only check if the requested file is on the correct filesystem, not if it is in the correct directory. This enables modifying files in /images, accessing other files on the same filesystem, and accessing files on other filesystems. This vulnerability is fixed in 1.5.10.30.
CVSS 6.4
CVE-2024-40645 WRITEUP HIGH WRITEUP
FOG Project < 1.5.10.41 - Rebranding Image Upload Code Execution
FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse. This vulnerability is fixed in 1.5.10.41.
CVSS 8.8
CVE-2024-41108 WRITEUP HIGH WRITEUP
fogproject 1.5.10-1.5.10.41 - Unauthenticated Information Disclosure via Hostinfo Page
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending on that host. Otherwise, an error message containing "Invalid tasking!" will be returned. The domainpassword in the hostinfo dump is hidden even to authenticated users, as it is displayed as a row of asterisks when navigating to the host's Active Directory settings. This vulnerability is fixed in 1.5.10.41.
CVSS 7.5