PT-2010-1279 · Varnish · Varnish

Published 2010-04-05 · Updated 2024-08-07 · CVE-2009-2936

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Varnish versions prior to 2.1.0

Description The Command Line Interface in the master process of the reverse proxy server does not require authentication for commands received through a TCP port. This allows remote attackers to execute arbitrary code via a vcl.inline directive, change the ownership of the master process via param.set, stop, and start directives, read the initial line of an arbitrary file via a vcl.load directive, or conduct cross-site request forgery (CSRF) attacks. The vendor disputes this report.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the TCP port used by the Command Line Interface to minimize the risk of exploitation. Avoid using the vcl.inline directive until the issue is resolved. Restrict the use of param.set, stop, and start directives to trusted sources. Limit the use of the vcl.load directive to necessary cases. Implement proper input validation of directives to prevent cross-site request forgery (CSRF) attacks.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-2936

Affected Products

Varnish

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/varnish/varnish_cli_login.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/varnish/varnish_cli_file_read.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35581 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2010-April/040359.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2936 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2936 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2936 · Security Note
• http://securityfocus.com/archive/1/510360/100/0/threaded · Note
• http://securityfocus.com/archive/1/510368/100/0/threaded · Note
• https://t.me/cvenotify/89579 · Telegram Post
• http://varnish-cache.org/wiki/CLI · Note
• http://varnish-cache.org/changeset/3865 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2936 · Note