CVE-2020-16152
CRITICALAerohive NetConfig 10.0r8a LFI and log poisoning to RCE
Title source: metasploitExploitation Summary
EIP tracks 3 public exploits for CVE-2020-16152.
PoCs published by Nate0634034090, eriknl, Erik de Jong, Erik Wynter, including Metasploit module exploits/unix/webapp/aerohive_netconfig_lfi_log_poison_rce.
AI-analyzed exploit summary This is a Metasploit module for CVE-2020-16152, targeting an authenticated RCE vulnerability in the WordPress Popular Posts plugin (<=5.3.2). It exploits improper input validation to upload a malicious PHP payload disguised as a GIF image, achieving remote code execution.
Description
The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.
Exploits (3)
This is a Metasploit module for CVE-2020-16152, targeting an authenticated RCE vulnerability in the WordPress Popular Posts plugin (<=5.3.2). It exploits improper input validation to upload a malicious PHP payload disguised as a GIF image, achieving remote code execution.
This PoC exploits a Local File Inclusion (LFI) vulnerability in Aerohive/Extreme Networks HiveOS via path truncation and log poisoning to achieve remote code execution (RCE) as root. The exploit leverages an outdated PHP version (5.2.17) to truncate the file path suffix and include arbitrary files.
This Metasploit module exploits CVE-2020-16152, combining LFI and log poisoning in Aerohive NetConfig to achieve unauthenticated RCE as root. It leverages PHP string truncation and log injection to execute arbitrary commands.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H