PT-2019-4524 · Rconfig · Rconfig

Vikingfr · Published 2019-11-07 · Updated 2023-01-31 · CVE-2019-19509

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rConfig version 3.9.3

Description The issue is related to errors in handling HTTP requests in the ajaxArchiveFiles.php component of the rConfig utility for managing network device configurations. Exploitation of this issue may allow a remote attacker to execute arbitrary commands in the target system by sending specially crafted GET requests. The path parameter is passed to the exec function without filtering, which can lead to command execution. A remote authenticated user can directly execute system commands by sending a GET request to "ajaxArchiveFiles.php".

Recommendations For rConfig version 3.9.3, consider disabling the ajaxArchiveFiles.php component or restricting access to it until a patch is available. As a temporary workaround, avoid using the path parameter in the affected "ajaxArchiveFiles.php" endpoint to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-00536

CVE-2019-19509

Affected Products

Rconfig

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_ajaxarchivefiles_rce.rb · Exploit
• 🔥 https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py · Exploit
• 🔥 https://exploit-db.com/exploits/48223 · Exploit
• 🔥 http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html · Exploit
• 🔥 https://github.com/v1k1ngfr · Exploit
• 🔥 http://packetstormsecurity.com/files/156766/Rconfig-3.x-Chained-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47982 · Exploit
• 🔥 http://packetstormsecurity.com/files/156950/rConfig-3.9.4-searchField-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-19509 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00536 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-19509 · Security Note
• https://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html · Note
• https://t.me/cvenotify/43233 · Telegram Post
• https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token= · Note