PT-2017-19199 · E2 · Openwebif Plugin

Bleyelmilo + 3 · Published 2017-06-22 · Updated 2017-10-13 · CVE-2017-9807

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenWebif plugin through 1.2.4 for E2 open devices

Description An issue in the OpenWebif plugin allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands. This is due to the saveConfig function in "plugin/controllers/models/config.py" performing an eval() call on the contents of the key HTTP GET parameter in the "api/saveconfig" endpoint.

Recommendations For OpenWebif plugin versions through 1.2.4, consider disabling the saveConfig function or restricting access to the "api/saveconfig" endpoint until a patch is available. Avoid using the key parameter in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-9807

Affected Products

Openwebif Plugin

References · 6

• 🔥 https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9807 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9807 · Security Note
• https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution · Note
• http://openwall.com/lists/oss-security/2017/10/02/4 · Note
• http://securityfocus.com/bid/99232 · Note