CVE-2019-7228

Related Files

ABB IDAL HTTP Server Uncontrolled Format String

Posted Jun 24, 2019

Authored by Eldar Marcussen

The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server. The IDAL HTTP server does not safely handle username or cookie strings during the authentication process. Attempting to authenticate with the username "%25s%25p%25x%25n" will crash the server. Sending "%08x.AAAA.%08x.%08x" will log memory content from the stack.

tags | exploit, web

advisories | CVE-2019-7228

SHA-256 | 2710131973cb651b312b3b4490bb6638b5ec8ddf6b94183de3c0860cb2228091

Download | Favorite | View