CVE-2014-3805
AlienVault OSSIM < 4.7.0 - Remote Code Execution via av-centerd SOAP Service
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-3805. PoCs published by Alfredo Ramirez, James Fitts.
AI-analyzed exploit summary This exploit leverages a command injection vulnerability in AlienVault OSSIM's av-centerd service via the SOAP API. The 'get_log_line' function is abused to append arbitrary commands (e.g., 'id') to log file requests, achieving remote code execution.
Description
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
Exploits (2)
This exploit leverages a command injection vulnerability in AlienVault OSSIM's av-centerd service via the SOAP API. The 'get_log_line' function is abused to append arbitrary commands (e.g., 'id') to log file requests, achieving remote code execution.
This Metasploit module exploits a command injection vulnerability in AlienVault OSSIM's av-centerd service via the get_log_line function. The exploit crafts a malicious SOAP request to inject a Perl payload, achieving remote code execution.