CVE-2013-4984
Sophos Web Appliance <3.7.9.1, <3.8-3.8.1.1 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-4984.
PoCs published by Metasploit, Core Security, Francisco Falcon, juan vazquez, including Metasploit module exploits/linux/local/sophos_wpa_clear_keys.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance's clear_keys.pl script to escalate privileges from the 'spiderman' user to root. It drops and executes a payload via the vulnerable script.
Description
The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance's clear_keys.pl script to escalate privileges from the 'spiderman' user to root. It drops and executes a payload via the vulnerable script.
The exploit demonstrates a pre-authentication OS command injection vulnerability in Sophos Web Protection Appliance. It leverages improper input sanitization in the '/opt/ws/bin/sblistpack' Perl script, allowing unauthenticated remote attackers to execute arbitrary commands via a crafted 'domain' POST parameter.
This Metasploit module exploits a command injection vulnerability in Sophos Web Protection Appliance's clear_keys.pl script to escalate privileges from the 'spiderman' user to 'root'. It drops and executes a payload via sudo abuse.