CVE-2014-2846
WD Arkeia Virtual Appliance Firmware < 10.2.7 - Path Traversal and Remote Code Execution via Lang Cookie Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-2846. PoCs published by SEC Consult.
AI-analyzed exploit summary The advisory describes a path traversal vulnerability in WD Arkeia Virtual Appliance (AVA) that allows unauthenticated remote attackers to retrieve arbitrary files and execute system commands via a maliciously crafted 'lang' cookie. The vulnerability exists in the /opt/arkeia/wui/htdocs/index.php script due to improper input validation.
Description
Directory traversal vulnerability in opt/arkeia/wui/htdocs/index.php in the WD Arkeia virtual appliance (AVA) with firmware before 10.2.9 allows remote attackers to read arbitrary files and execute arbitrary PHP code via a ..././ (dot dot dot slash dot slash) in the lang Cookie parameter, as demonstrated by a request to login/doLogin.
Exploits (1)
The advisory describes a path traversal vulnerability in WD Arkeia Virtual Appliance (AVA) that allows unauthenticated remote attackers to retrieve arbitrary files and execute system commands via a maliciously crafted 'lang' cookie. The vulnerability exists in the /opt/arkeia/wui/htdocs/index.php script due to improper input validation.