PT-2019-4114 · Netflix · Exhibitor Web Ui

Published 2019-11-13 · Updated 2022-06-07 · CVE-2019-5029

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Exhibitor Web UI versions 1.0.9 through 1.7.1

Description A command injection issue exists in the Config editor of the Exhibitor Web UI. This allows an attacker to insert arbitrary shell commands surrounded by backticks or $() into the editor, which will be executed by the Exhibitor process when it launches ZooKeeper. As a result, an attacker can execute any command as the user running the Exhibitor process. The vulnerability can be exploited by a remote attacker to execute commands with the privileges of the target user.

Recommendations For Exhibitor Web UI versions 1.0.9 through 1.7.1, consider disabling the Config editor feature until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the Exhibitor process to minimize the risk of exploitation. Avoid using the backticks or $() syntax in the Config editor to prevent command injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-04685

CVE-2019-5029

Affected Products

Exhibitor Web Ui

References · 8

• 🔥 https://github.com/thehunt1s0n/Exihibitor-RCE · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0790 · Exploit
• 🔥 https://exploit-db.com/exploits/48654 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5029 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5029 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04685 · Security Note
• https://cybersecurity-help.cz/vdb/SB2019111418 · Note
• https://securitylab.ru/vulnerability/502571.php · Note