CVE-2020-12078
HIGHOpen-AudIT 3.3.1 - OS Command Injection via Discovery Settings Exclude IP Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-12078. PoCs published by mhaskar, 84KaliPleXon3.
AI-analyzed exploit summary This exploit targets Open-AudIT Professional v3.3.1 by injecting a reverse shell payload into the configuration settings and triggering it via a discovery scan. It requires authentication and uses a PATCH request to modify settings, followed by a discovery execution to achieve RCE.
Description
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in the discoveries_helper.php file (inside the all_ip_list function) without being filtered, which means that the attacker can provide a payload instead of a valid IP address.
Exploits (2)
This exploit targets Open-AudIT Professional v3.3.1 by injecting a reverse shell payload into the configuration settings and triggering it via a discovery scan. It requires authentication and uses a PATCH request to modify settings, followed by a discovery execution to achieve RCE.
This exploit targets Open-AudIT Professional v3.3.1 by injecting a reverse shell payload into the configuration settings and triggering it via a discovery scan. It requires authentication and uses a PATCH request to modify configuration followed by a discovery execution to achieve RCE.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H