Exploitation Summary
EIP tracks 3 public exploits for CVE-2012-10048.
PoCs published by Metasploit, Brendan Coles, bcoles, including Metasploit module exploits/linux/http/zenoss_showdaemonxmlconfig_exec.
AI-analyzed exploit summary This Metasploit module exploits a command execution vulnerability in Zenoss 3.x by leveraging the 'showDaemonXMLConfig' endpoint, which passes user-controlled input from the 'daemon' parameter to a Popen() call. It requires authentication and executes arbitrary commands under the context of the 'zenoss' user.
Description
Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.
Exploits (3)
This Metasploit module exploits a command execution vulnerability in Zenoss 3.x by leveraging the 'showDaemonXMLConfig' endpoint, which passes user-controlled input from the 'daemon' parameter to a Popen() call. It requires authentication and executes arbitrary commands under the context of the 'zenoss' user.
This exploit demonstrates multiple vulnerabilities in Zenoss 3.2.1 and prior, including command execution, XSS, open redirect, directory traversal, and information disclosure. The PoC provides URLs to exploit these issues without requiring authentication.
This Metasploit module exploits a command execution vulnerability in Zenoss 3.x by leveraging the show_daemon_xml_configs() function in ZenossInfo.py, which calls Popen() with user-controlled data from the 'daemon' parameter. It sends a crafted POST request to execute arbitrary commands under the context of the 'zenoss' user.
References (6)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N