CVE-2019-13623

EIP tracks 1 public exploit for CVE-2019-13623. PoCs published by Etienne Lacoche.

AI-analyzed exploit summary This exploit leverages CVE-2019-13623 in Ghidra by replacing the decompile binary with a malicious script that establishes a reverse shell. The exploit packages the binary into a .gar file, which when restored in Ghidra, executes the payload.

In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module.