CVE-2017-11467
CRITICAL EXPLOITED IN THE WILDOrientDB < 2.2.22 - Remote Code Execution via Unprivileged Query Operations
Title source: llmExploitation Summary
CVE-2017-11467 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 2 public exploits from researchers including SecuriTeam, Francis Alexander - Beyond Security\, , # Public PoC, including a Metasploit module exploits/multi/http/orientdb_exec.
AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in OrientDB (CVE-2017-11467) where unprivileged users can bypass RBAC restrictions to execute arbitrary Groovy code, leading to remote command execution. The PoC automates privilege escalation and deploys a reverse shell via a crafted Groovy function.
Description
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.
Exploits (2)
This exploit leverages a privilege escalation vulnerability in OrientDB (CVE-2017-11467) where unprivileged users can bypass RBAC restrictions to execute arbitrary Groovy code, leading to remote command execution. The PoC automates privilege escalation and deploys a reverse shell via a crafted Groovy function.
This Metasploit module exploits a privilege escalation vulnerability in OrientDB 2.2.x to execute unsandboxed OS commands via a crafted Groovy function. It leverages HTTP Basic Auth to create and trigger a malicious function, then cleans up by deleting it.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H