CVE-2014-8517
macOS X - Remote Command Execution via HTTP Redirect Pipe Character
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-8517.
PoCs published by Metasploit, dash, Jared McNeill, wvu, including Metasploit module exploits/unix/http/tnftp_savefile.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-8517 in tnftp by leveraging the arbitrary command execution vulnerability when the output filename begins with a '|' character, allowing command injection via the popen() function.
Description
The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.
Exploits (3)
This Metasploit module exploits CVE-2014-8517 in tnftp by leveraging the arbitrary command execution vulnerability when the output filename begins with a '|' character, allowing command injection via the popen() function.
This exploit leverages CVE-2014-8517 in tnftp (FreeBSD FTP client) by intercepting HTTP requests and injecting a malicious redirect to execute an xterm command via pipe injection. It requires DNS spoofing to redirect the victim to a fake webserver.
This Metasploit module exploits CVE-2014-8517 in tnftp by crafting a malicious URI that triggers command execution via the 'savefile' feature when the output filename starts with a '|' character.