CVE-2012-4347
Symantec Messaging Gateway 9.5.x - Authenticated Path Traversal via Log Export or Backup Restore
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-4347.
PoCs published by Ben Williams, including Metasploit module auxiliary/scanner/http/symantec_brightmail_logfile.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file download vulnerability in Symantec Messaging Gateway 9.5.3-3 via directory traversal in crafted URLs. It allows authenticated attackers to retrieve sensitive files like /etc/passwd by manipulating the logFile parameter.
Description
Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.
Exploits (2)
This exploit demonstrates an arbitrary file download vulnerability in Symantec Messaging Gateway 9.5.3-3 via directory traversal in crafted URLs. It allows authenticated attackers to retrieve sensitive files like /etc/passwd by manipulating the logFile parameter.
This Metasploit module exploits a directory traversal vulnerability in Symantec Messaging Gateway 9.5 to download arbitrary files by manipulating the 'logFile' parameter. Authentication is required to exploit this vulnerability.