PT-2020-20252 · Eyesofnetwork · Eyesofnetwork

H4Knet · Published 2020-02-06 · Updated 2021-12-30 · CVE-2020-8654

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3

Description An issue allows an authenticated web user with sufficient privileges to abuse the AutoDiscovery module and run arbitrary OS commands via the "module/module frame/index.php autodiscovery.php" target field.

Recommendations For EyesOfNetwork version 5.3, consider restricting access to the AutoDiscovery module until a patch is available. As a temporary workaround, avoid using the AutoDiscovery module to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-8654

Affected Products

Eyesofnetwork

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb · Exploit
• 🔥 https://github.com/EyesOfNetworkCommunity/eonweb/issues/50 · Exploit
• 🔥 https://exploit-db.com/exploits/48025 · Exploit
• 🔥 https://exploit-db.com/exploits/48169 · Exploit
• 🔥 http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8654 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8654 · Vendor Advisory