CVE-2013-6221

HP Service Virtualization 3.x < 3.50.1 - Path Traversal and Arbitrary File Write via CommunicationServlet

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2013-6221. PoCs published by Metasploit, including Metasploit module exploits/windows/http/hp_autopass_license_traversal.

AI-analyzed exploit summary This Metasploit module exploits CVE-2013-6221 in HP AutoPass License Server by leveraging unauthenticated file upload and directory traversal to deploy a malicious WAR file via a JSP dropper, achieving remote code execution.

Description

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotejava

https://www.exploit-db.com/exploits/33891

View Code ZIP pw:eip

This Metasploit module exploits CVE-2013-6221 in HP AutoPass License Server by leveraging unauthenticated file upload and directory traversal to deploy a malicious WAR file via a JSP dropper, achieving remote code execution.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: HP AutoPass License Server 8.01 / HP Service Virtualization 3.50

No auth needed

Prerequisites: Network access to the target server · HP AutoPass License Server with vulnerable CommunicationServlet component

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC GREAT

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb