CVE-2009-4648
Accellion Secure File Transfer Appliance - Privilege Escalation via Sudo Command Argument Injection
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-4648. PoCs published by Tim Brown.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Accellion File Transfer Appliance, including privilege escalation and directory traversal. It provides commands to manipulate file permissions and execute arbitrary code with superuser privileges.
Description
Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in Accellion File Transfer Appliance, including privilege escalation and directory traversal. It provides commands to manipulate file permissions and execute arbitrary code with superuser privileges.