CVE-2015-2857

Related Files

Accellion FTA getStatus verify_oauth_token Command Execution

Posted Jul 13, 2015

Authored by H D Moore | Site metasploit.com

This Metasploit module exploits a metacharacter shell injection vulnerability in the Accellion File Transfer appliance. This vulnerability is triggered when a user-provided 'oauth_token' is passed into a system() call within a mod_perl handler. This Metasploit module exploits the '/tws/getStatus' endpoint. Other vulnerable handlers include '/seos/find.api', '/seos/put.api', and /seos/mput.api'. This issue was confirmed on version FTA_9_11_200, but may apply to previous versions as well. This issue was fixed in software update FTA_9_11_210.

tags | exploit, shell

advisories | CVE-2015-2857

SHA-256 | 6469c1b4105f729eff01d7b1743b30cbc9388e3b867763c2295eb78c0197f9dc

Download | Favorite | View