CVE-2019-1821
HIGH EXPLOITED NUCLEICisco Prime Infrastructure/EPN Manager - RCE
Title source: llmExploitation Summary
CVE-2019-1821 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Metasploit, mr_me, k8gege, including a Metasploit module exploits/linux/http/cpi_tararchive_upload.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in Cisco Prime Infrastructure's TarArchive Java class to upload a JSP payload to the Apache Tomcat web apps directory, achieving unauthenticated remote code execution.
Description
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
Exploits (5)
This Metasploit module exploits a directory traversal vulnerability in Cisco Prime Infrastructure's TarArchive Java class to upload a JSP payload to the Apache Tomcat web apps directory, achieving unauthenticated remote code execution.
This exploit leverages a directory traversal vulnerability in Cisco Prime Infrastructure's Health Monitor HA TarArchive feature to upload a malicious JSP file, achieving remote code execution. The JSP file establishes a reverse shell to the attacker's specified IP and port.
The repository contains a functional Python exploit for CVE-2019-1821, which leverages a directory traversal vulnerability in Cisco Prime Infrastructure's Health Monitor HA TarArchive feature to achieve unauthenticated remote code execution. The exploit crafts a malicious tar archive containing a JSP payload, uploads it via the vulnerable endpoint, and establishes a reverse shell.
The repository contains a functional Python exploit for CVE-2019-1821, which leverages a directory traversal vulnerability in Cisco Prime Infrastructure's Health Monitor HA TarArchive feature to achieve unauthenticated remote code execution. The exploit crafts a malicious tar archive containing a JSP payload, uploads it via an unauthenticated endpoint, and establishes a reverse shell.
This Metasploit module exploits a directory traversal vulnerability in Cisco Prime Infrastructure's TarArchive class to upload a malicious JSP file, achieving unauthenticated remote code execution.
Nuclei Templates (1)
http.title:"prime infrastructure"
title="prime infrastructure"
References (3)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H