Exploitation Summary
EIP tracks 2 public exploits for CVE-2010-4417.
PoCs published by Metasploit, 1c239c43f521145fa8385d64a9c32243, including Metasploit module exploits/windows/http/oracle_beehive_evaluation.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-4417 in Oracle BeeHive 2 by abusing the processEvaluation method in voice-servlet to upload a malicious JSP stager, which then writes and executes a payload, achieving remote code execution as SYSTEM.
Description
Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.
Exploits (2)
This Metasploit module exploits CVE-2010-4417 in Oracle BeeHive 2 by abusing the processEvaluation method in voice-servlet to upload a malicious JSP stager, which then writes and executes a payload, achieving remote code execution as SYSTEM.
This Metasploit module exploits a vulnerability in Oracle BeeHive 2's voice-servlet processEvaluation() method to upload a malicious JSP stager and achieve remote code execution as SYSTEM. The exploit leverages directory traversal and file upload to deploy a payload executable.