CVE-2000-0670

CVSWeb 1.80 - Authenticated Remote Command Execution via Shell Metacharacters

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2000-0670. PoCs published by Joey Hess.

AI-analyzed exploit summary CVE-2000-0670 exploits an insecure Perl `open` call in Cvsweb 1.80, allowing command injection via a maliciously crafted filename. The PoC demonstrates arbitrary command execution by embedding shellcode in a filename, which is executed when the file is viewed in a directory listing.

Description

The cvsweb CGI script in CVSWeb 1.80 allows remote attackers with write access to a CVS repository to execute arbitrary commands via shell metacharacters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Joey Hess · textlocalunix

https://www.exploit-db.com/exploits/20073

View Code ZIP pw:eip

CVE-2000-0670 exploits an insecure Perl `open` call in Cvsweb 1.80, allowing command injection via a maliciously crafted filename. The PoC demonstrates arbitrary command execution by embedding shellcode in a filename, which is executed when the file is viewed in a directory listing.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Cvsweb 1.80

Auth required

Prerequisites: Write access to the CVS repository · Ability to commit files with crafted names

MITRE ATT&CK