CVE-2014-3804
AlienVault OSSIM < 4.7.0 - Remote Code Execution via av-centerd SOAP Service
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-3804.
PoCs published by Metasploit, James Fitts, Unknown, juan vazquez, including Metasploit module exploits/linux/ids/alienvault_centerd_soap_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in AlienVault OSSIM's av-centerd SOAP service. It leverages insecure use of Perl backticks in the update_system_info_debian_package method to execute arbitrary commands, achieving remote code execution.
Description
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in AlienVault OSSIM's av-centerd SOAP service. It leverages insecure use of Perl backticks in the update_system_info_debian_package method to execute arbitrary commands, achieving remote code execution.
This exploit leverages a command injection vulnerability in Alienvault OSSIM's av-centerd Util.pm sync_rserver function due to an incomplete blacklist for the $uuid parameter. It sends a maliciously crafted SOAP request to execute arbitrary commands as root.
This Metasploit module exploits a command injection vulnerability in AlienVault OSSIM av-centerd SOAP web service (CVE-2014-3804). It leverages insecure use of perl backticks in the update_system_info_debian_package method to execute arbitrary commands.