Exploitation Summary
EIP tracks 3 public exploits for CVE-2009-2011.
PoCs published by Metasploit, Core Security, jduck, including Metasploit module exploits/windows/browser/dxstudio_player_exec.
AI-analyzed exploit summary This exploit leverages a command execution vulnerability in Worldweaver DX Studio Player by crafting a malicious .dxstudio file that writes a batch script to disk and executes it via shell.execute(). It targets the ActiveX and Firefox plugin versions of the player.
Description
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote attackers to execute arbitrary commands via a .dxstudio file that invokes this method.
Exploits (3)
This exploit leverages a command execution vulnerability in Worldweaver DX Studio Player by crafting a malicious .dxstudio file that writes a batch script to disk and executes it via shell.execute(). It targets the ActiveX and Firefox plugin versions of the player.
The exploit demonstrates a command injection vulnerability in the DX Studio Player Firefox plug-in, allowing arbitrary command execution via the `shell.execute()` method without user warnings in Firefox. The PoC includes an XML file that triggers the execution of `cmd.exe` with a test command.
This Metasploit module exploits a command execution vulnerability in DX Studio Player by crafting a malicious .dxstudio file that writes a batch file to disk and executes it via the ActiveX control. The exploit leverages the plugin's unsafe handling of script execution to achieve RCE.