Exploitation Summary
EIP tracks 3 public exploits for CVE-2019-5029. PoCs published by Logan Sanderson, thehunt1s0n, yZee00.
AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands can be executed by injecting them into the 'java.env script' field, which are then passed unmodified to the Java command launching ZooKeeper.
Description
An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.
Exploits (3)
This exploit demonstrates a command injection vulnerability in Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands can be executed by injecting them into the 'java.env script' field, which are then passed unmodified to the Java command launching ZooKeeper.
This repository contains a functional exploit for CVE-2019-5029, targeting Exhibitor Web UI 1.7.1. The exploit leverages command injection via the 'javaEnvironment' parameter in a POST request to achieve remote code execution (RCE).
This repository contains a Python script PoC for CVE-2019-5029, which exploits a Remote Code Execution (RCE) vulnerability in Exhibitor Web UI version 1.7.1. The script is designed to be executed with target and attacker IP/port details.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H