CVE-2012-4957
published 2012-11-18CVE-2012-4957: Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with…
PriorityP263high7.8CVSS 2.0
AVNACLAuNCCINAN
EXPLOIT
EPSS
67.09%
99.2th percentile
Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | file_reporter | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
SRS<msg>SERVER (MD5 prefix pattern for request authentication)
- →Detect HTTPS POST requests to /FSF/CMD or /SRS/CMD on port 3037 containing SRS record XML with PATH elements pointing to absolute or traversal paths (e.g., '../../'). ↗
- →Look for SRS record requests with OPERATION 4 and CMD 103 in the POST body to /FSF/CMD, which is the specific operation used to retrieve arbitrary files. ↗
- →Detect creation or modification of files under C:\Windows\System32\wbem\mof\ (especially .mof files) by NFRAgent.exe, which indicates MOF-based WMI persistence being dropped via the path traversal write primitive. ↗
- →Requests to NFRAgent on port 3037 with a body prefixed by an uppercase MD5 hex digest (32 chars) followed by 'FSFUI' are characteristic of exploit tool authentication; alert on this pattern. ↗
- ·The exploit targets NFR Agent versions 1.0.4.3 (File Reporter 1.0.2) and 1.0.3.22 (File Reporter 1.0.1); detections should be scoped to hosts running these specific versions of NFRAgent.exe. ↗
- ·The exploit uses HTTPS (not plain HTTP) on port 3037; network detection rules must inspect TLS traffic (via decryption/inspection proxy) or rely on endpoint-based detection to be effective. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
exploitdb·2012-12-12·CVSS 10.0
CVE-2012-4959 [CRITICAL] Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
---
# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit
import httplib, md5, sys
def message_MD5(arg):
v = "SRS" + arg + "SERVER"
m = md5.new(v)
return m.hexdigest()
def genMof(command="net user abysssec 123456 /add"):
vbs = ""
vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
vbs += "\"objShell.Run \\\"cmd.exe /C "
vbs += command
vbs += "\\\"\""
mof = """
#pragma namespace ("\\\\\\\\.\\\\root\\\\subscrip
Metasploit
NFR Agent SRS Record Arbitrary Remote File Access
metasploit
NFR Agent SRS Record Arbitrary Remote File Access
NFR Agent SRS Record Arbitrary Remote File Access
NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve arbitrary files via a request to /FSF/CMD with a SRS Record with OPERATION 4 and CMD 103, specifying a full pathname. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1).
No writeups or analysis indexed.
2012-11-18
Published