CVE-2011-2653
published 2011-12-08CVE-2011-2653: Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
73.93%
99.4th percentile
Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | zenworks_asset_management | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect POST requests to /rtrlet/catch with multipart/form-data content type, which is the upload endpoint abused by the CatchFileServlet path traversal exploit. ↗
- →Filter on the Apache-Coyote server banner to scope detection to vulnerable Novell ZENworks Asset Management 7.5 instances running on Tomcat. ↗
- →Path traversal depth of 3 directory levels is used to reach the Tomcat webapps directory; look for '../../../' sequences in multipart upload filenames targeting /rtrlet/catch. ↗
- ·The uploaded WAR file's app name and JSP name are randomly generated alphanumeric strings, so static filename-based detection is not reliable; focus on the upload endpoint and subsequent JSP execution pattern instead. ↗
- ·The multipart boundary is also randomized per request, preventing static boundary-string matching; detection should key on the URI /rtrlet/catch combined with multipart/form-data and WAR file content. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell ZENworks Asset Management - Remote Execution (Metasploit)
exploitdb·2012-08-15
CVE-2011-2653 Novell ZENworks Asset Management - Remote Execution (Metasploit)
Novell ZENworks Asset Management - Remote Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 [ /Apache-Coyote/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
def initialize(info = {})
super(update_info(info,
'Name' => 'Novell ZENworks Asset Management Remote Execution',
'Description' => %q{
This module exploits a path traversal flaw in Novell ZENworks Asset Management
7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file
outside of the MalibuUploadDirectory and then make a secondary reques
Metasploit
Novell ZENworks Asset Management Remote Execution
metasploit
Novell ZENworks Asset Management Remote Execution
Novell ZENworks Asset Management Remote Execution
This module exploits a path traversal flaw in Novell ZENworks Asset Management 7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file outside of the MalibuUploadDirectory and then make a secondary request that allows for arbitrary code execution.
No writeups or analysis indexed.
2011-12-08
Published