CVE-2017-14143
CRITICALKaltura Server < mercury-13.1.0 - Remote Code Execution via Hardcoded Cookie Secret
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2017-14143.
PoCs published by Metasploit, Robin Verton, Robin Verton <[email protected]>, Mehmet Ince <[email protected]>, including Metasploit module exploits/linux/http/kaltura_unserialize_cookie_rce.
AI-analyzed exploit summary This Metasploit module exploits a PHP object injection vulnerability in Kaltura via a hardcoded cookie secret, allowing unauthenticated RCE through a crafted serialized payload. It leverages a Zend Framework POP chain to execute arbitrary PHP code.
Description
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.
Exploits (3)
This Metasploit module exploits a PHP object injection vulnerability in Kaltura via a hardcoded cookie secret, allowing unauthenticated RCE through a crafted serialized payload. It leverages a Zend Framework POP chain to execute arbitrary PHP code.
This exploit leverages a PHP object injection vulnerability in Kaltura <= 13.1.0 via deserialization of a malicious payload in the 'userzone' cookie. It achieves remote code execution by abusing the Zend_Log and Zend_Mail classes to execute arbitrary PHP code.
This Metasploit module exploits a PHP object injection vulnerability in Kaltura via a crafted serialized cookie. It leverages a hardcoded cookie secret to bypass signature checks and achieve remote code execution through a Zend Framework deserialization gadget chain.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H