CVE-2012-10040
CRITICALOpenfiler 2.x - Authenticated OS Command Injection via system.html Device Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-10040.
PoCs published by Metasploit, bcoles, including Metasploit module exploits/linux/http/openfiler_networkcard_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated command injection vulnerability in Openfiler v2.x via the 'device' parameter in 'system.html', allowing arbitrary command execution as the 'openfiler' user, which can escalate to root via sudo.
Description
Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.
Exploits (2)
This Metasploit module exploits an authenticated command injection vulnerability in Openfiler v2.x via the 'device' parameter in 'system.html', allowing arbitrary command execution as the 'openfiler' user, which can escalate to root via sudo.
This Metasploit module exploits a command injection vulnerability in Openfiler v2.x by leveraging the 'device' parameter in 'system.html' to execute arbitrary commands via the 'NetworkCard' class constructor. The exploit authenticates with provided credentials and sends a crafted payload to achieve remote code execution under the 'openfiler' user context.
References (5)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H