CVE-2007-2027

Elinks 0.11.1 - Format String Injection via Untrusted Gettext Message Catalog

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-2027. PoCs published by Arnaud Giersch.

AI-analyzed exploit summary This exploit leverages a vulnerability in ELinks by manipulating locale files to execute arbitrary code. The attacker tricks the victim into running ELinks in a controlled directory with a modified .mo file, leading to potential RCE.

Description

Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a "../po" directory, which can be leveraged to conduct format string attacks.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Arnaud Giersch · textlocallinux

https://www.exploit-db.com/exploits/29954

View Code ZIP pw:eip

This exploit leverages a vulnerability in ELinks by manipulating locale files to execute arbitrary code. The attacker tricks the victim into running ELinks in a controlled directory with a modified .mo file, leading to potential RCE.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: ELinks 0.11.1

No auth needed

Prerequisites: Victim must run ELinks in attacker-controlled directory · Presence of locale files

MITRE ATT&CK