CVE-2017-15220

CRITICAL

VX Search Enterprise 10.1.12 - Remote Buffer Overflow

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2017-15220 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Proofs of concept

2

Catalogued exploits

ExploitDBVX Search Enterprise 10.1.12 - Remote Buffer OverflowExploitDB exploitby Revnic VasileNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubvasilerevnic/CVE-2017-15220-vxsearch-rceRepository PoCby vasilerevnic0Exploit2 files

4.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2017-15220 targeting VX Search Enterprise 10.1.12. It sends a crafted HTTP POST request with a long URI containing a buffer overflow payload, including an egghunter and shellcode, to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a public exploit for CVE-2017-15220 (VX Search Enterprise buffer overflow) and a README. The Python script constructs a standard buffer overflow payload (egghunter + bind shell shellcode) and sends it to a hardcoded target IP. No backdoor, deceptive payload, or operator-directed harm targeting the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareFlexense VX Search Enterprise
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious payload to exploit a buffer overflow and execute arbitrary code, which is the definition of an exploit.

CVE-2017-15220.py:93-102

Requirements

  • Target must be running VX Search Enterprise 10.1.12 on Windows 7 x86 Pro SP1 (or compatible).CVE-2017-15220.py:9
  • Attacker must be able to connect to the target on port 80.CVE-2017-15220.py:101

Observed behavior

  • Constructs a buffer overflow payload with a NOP sled, egghunter, egg marker, and shellcode.CVE-2017-15220.py:83-91
  • Sends an HTTP POST request with the payload embedded in a long URI starting with /../.CVE-2017-15220.py:93-97
  • Connects to a hardcoded IP address (payload withheld) on port 80 and transmits the exploit buffer.CVE-2017-15220.py:100-102
  • The shellcode (generated by msfvenom) opens a bind shell on TCP port 4444.CVE-2017-15220.py:20
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
Payload withheldThe shellcode opens a bind shell on the target, which is the intended exploit behavior against the stated vulnerable software.CVE-2017-15220.py:20-68
Target Ip
Payload withheldHardcoded target IP address used in the exploit connection; typical for a PoC and not indicative of a backdoor against the user.CVE-2017-15220.py:94CVE-2017-15220.py:101
Review boundaries

What the analysis did not establish

  • The shellcode is provided as a hex-encoded blob; its exact behavior is not independently verified.
  • The exploit hardcodes a target IP (payload withheld) and port 80; no scanning or target detection logic is present.
  • The README.md file is a brief description and does not contain executable code.
  • Only the two text files (CVE-2017-15220.py and README.md) were provided; no binary files or other artifacts were present.
  • The shellcode is opaque binary data and was not disassembled, but its declared purpose (bind shell on target) is consistent with the exploit context and no local harm is indicated.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2