CVE-2013-2068
Red Hat CloudForms Management Engine 2.0 - Path Traversal and Arbitrary File Write
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-2068.
PoCs published by Metasploit, including Metasploit module exploits/linux/http/cfme_manageiq_evm_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits a path traversal vulnerability (CVE-2013-2068) in Red Hat CloudForms Management Engine 5.1 by uploading a malicious Ruby controller file to the application's controllers directory. The payload is executed by sending a request to the uploaded controller's action.
Description
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Exploits (2)
This Metasploit module exploits a path traversal vulnerability (CVE-2013-2068) in Red Hat CloudForms Management Engine 5.1 by uploading a malicious Ruby controller file to the application's controllers directory. The payload is executed by sending a request to the uploaded controller's action.
This Metasploit module exploits a path traversal vulnerability (CVE-2013-2068) in Red Hat CloudForms Management Engine 5.1 to upload a malicious Ruby controller and execute arbitrary code. It leverages the 'linuxpkgs' action in the 'agent' controller to achieve remote code execution.