CVE-2009-2936
Varnish < 2.1.0 - Unauthenticated Remote Code Execution via CLI vcl.inline Directive
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2009-2936.
PoCs published by Patrick Webster, patrick, h00die <[email protected]>, aushack, h00die <[email protected]>, including Metasploit module auxiliary/scanner/varnish/varnish_cli_file_read.
AI-analyzed exploit summary This Metasploit module exploits CVE-2009-2936 by brute-forcing the Varnish Cache CLI interface to gain unauthorized access. Upon successful authentication, it attempts to read the /etc/shadow file to extract the root password hash.
Description
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.
Exploits (3)
This Metasploit module exploits CVE-2009-2936 by brute-forcing the Varnish Cache CLI interface to gain unauthorized access. Upon successful authentication, it attempts to read the /etc/shadow file to extract the root password hash.
This Metasploit module exploits a file read vulnerability in Varnish Cache CLI by abusing the error message when compiling a file with vcl.load. It attempts to read the first line of a specified file, such as /etc/passwd, by leveraging the debug message returned upon failure.
This Metasploit module attempts to brute-force login to the Varnish Cache CLI by testing passwords from a provided wordlist. It checks if authentication is required and reports successful logins.