CVE-2012-10040: Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose…

PriorityP269critical9.4CVSS 4.0

AVNACLATNPRLUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EXPLOIT

EPSS

2.48%

82.5th percentile

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
openfiler	openfiler	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/system.html↗

path/network.inc↗

→Monitor HTTP POST/GET requests to system.html containing shell metacharacters or command injection payloads in the 'device' parameter. ↗
→Alert on the openfiler OS user executing 'sudo /bin/bash' without a password, which indicates privilege escalation following exploitation. ↗
→Detect processes spawned as the 'openfiler' user that are children of a web server process, particularly shell or command execution, indicating successful RCE via the NetworkCard constructor. ↗

·Exploitation requires prior authentication to the Openfiler web interface; unauthenticated access alone is insufficient to trigger the vulnerability. ↗
·The privilege escalation to root is contingent on a misconfigured sudoers file specific to the Openfiler installation; this may not be present in all deployments. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.