CVE-2009-4489

Cherokee < 0.99.31 - Remote Code Execution via Terminal Emulator Escape Sequence

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4489. PoCs published by evilaliv3.

AI-analyzed exploit summary This exploit leverages a command injection vulnerability in Cherokee web server by sending a maliciously crafted HTTP request with escape sequences that execute arbitrary commands. The vulnerability arises from improper sanitization of user-supplied input in logfiles.

Description

header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.

Exploits (1)

exploitdb WORKING POC VERIFIED

by evilaliv3 · textremotewindows

https://www.exploit-db.com/exploits/33501

View Code ZIP pw:eip

This exploit leverages a command injection vulnerability in Cherokee web server by sending a maliciously crafted HTTP request with escape sequences that execute arbitrary commands. The vulnerability arises from improper sanitization of user-supplied input in logfiles.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Cherokee <= 0.99.30

No auth needed

Prerequisites: Network access to the target Cherokee server

MITRE ATT&CK