Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-14706.
PoCs published by Mehmet Ince <[email protected]>, including Metasploit module exploits/linux/http/denyall_waf_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in DenyAll Web Application Firewall (CVE-2017-14706). It first extracts an iToken from a debug endpoint, then uses it to execute arbitrary commands via a POST request to a vulnerable endpoint.
Description
DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.
Exploits (1)
This Metasploit module exploits an unauthenticated command injection vulnerability in DenyAll Web Application Firewall (CVE-2017-14706). It first extracts an iToken from a debug endpoint, then uses it to execute arbitrary commands via a POST request to a vulnerable endpoint.
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H