CVE-2018-19518
HIGH EXPLOITED RANSOMWARE NUCLEIUniversity of Washington IMAP Toolkit 2007f - Command Injection
Title source: llmExploitation Summary
CVE-2018-19518 has been observed exploited in the wild (reported by VulnCheck KEV), including in ransomware campaigns.
EIP tracks 5 public exploits from researchers including Metasploit, houqe, ensimag-security, including a Metasploit module exploits/linux/http/php_imap_open_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2018-19518, a vulnerability in PHP's imap_open function that allows remote code execution by leveraging the ProxyCommand option in SSH when rsh is mapped to SSH on Debian-based systems. It targets applications like Prestashop, SuiteCRM, and e107 v2 by injecting a malicious command through IMAP configuration settings.
Description
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
Exploits (5)
This Metasploit module exploits CVE-2018-19518, a vulnerability in PHP's imap_open function that allows remote code execution by leveraging the ProxyCommand option in SSH when rsh is mapped to SSH on Debian-based systems. It targets applications like Prestashop, SuiteCRM, and e107 v2 by injecting a malicious command through IMAP configuration settings.
This PoC exploits CVE-2018-19518, a command injection vulnerability in the target software, by sending a crafted HTTP POST request with a base64-encoded reverse shell payload. The exploit writes a reverse shell script to /tmp/test and executes it.
This repository contains a functional exploit for CVE-2018-19518, which leverages the `imap_open()` function in PHP to achieve remote code execution (RCE) via the `-oProxyCommand` argument. The exploit demonstrates how to bypass disabled functions by injecting a base64-encoded command into the hostname parameter.
This repository contains a working proof-of-concept exploit for CVE-2018-19518, which leverages a command injection vulnerability in PHP's imap_open function. The exploit demonstrates how to bypass disable_functions via the ProxyCommand parameter in the IMAP server string.
This Metasploit module exploits CVE-2018-19518, a vulnerability in PHP's imap_open function that allows remote code execution by leveraging the ProxyCommand option in SSH when rsh is mapped to SSH on Debian-based systems. It targets applications like Prestashop, SuiteCRM, e107, and Horde IMP H3.
Nuclei Templates (1)
References (20)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H