CVE-2013-2068
published 2013-09-28CVE-2013-2068: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite…
PriorityP265critical9.4CVSS 2.0
AVNACLAuNCNICAC
EXPLOIT
EPSS
58.62%
99.0th percentile
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | cloudforms_management_engine | — | — |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://host/agent/log?&id=8dfc29fe-a118-11e2-805c-005056920a2c&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJwrKM9LTQEABokCHw==↗
urlhttps://host/agent/upload?&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJyrd/VxKyjPS00BABDkA3U=&md5=b131830a18266f83111d9149adb6451d&version=1↗
urlhttps://host/agent/linuxpkgs?&filename=../../../../../../../../../var/www/miq/vmdb/public/pwned.txt&data=eJwrKM9LTQEABokCHw==&md5=5e93de3efa544e85dcd6311732d28f95↗
bytes↗
eJwrKM9LTQEABokCHw==
bytes↗
eJyrd/VxKyjPS00BABDkA3U=
- →Detect unauthenticated HTTP requests to /agent/log, /agent/upload, or /agent/linuxpkgs containing a 'filename' parameter with directory traversal sequences (../) — no authentication is required for these endpoints. ↗
- →Alert on HTTP requests to /agent/linuxpkgs, /agent/upload, or /agent/log where the 'filename' parameter contains '../' path traversal sequences targeting sensitive Rails application directories such as app/controllers/ or config/. ↗
- →The Metasploit exploit checks for a vulnerable target by requesting /ping.html and matching the response body for 'EVM ping response' — monitor for this reconnaissance pattern. ↗
- →The exploit uploads a fake Rails controller file via path traversal to app/controllers/<random>_controller.rb, then issues a POST request to /<controller>/<action> to achieve RCE — detect creation of unexpected .rb files in the controllers directory. ↗
- →The 'data' parameter in exploit requests is zlib-deflated and base64-encoded; detect POST/GET requests to /agent/* where 'data' contains base64 blobs alongside a 'filename' parameter with traversal sequences and an 'md5' parameter. ↗
- →The mtime parameter in /agent/log requests can be used to set file modification time to hide newly created files from time-based forensic searches — look for mtime parameter in agent/log requests. ↗
- ·The /agent/upload endpoint requires a valid platform magic bytes prefix (ELF header \x7f\x45\x4c\x46) in the first 4 bytes of the data parameter and a matching MD5 checksum — exploit payloads must satisfy this constraint. ↗
- ·The /agent/log endpoint requires a valid host GUID (id parameter) that has at least one associated proxy — unauthenticated exploitation still requires a valid GUID. ↗
- ·Uploading a routing file (routes.rb) via the ROUTES option is flagged as potentially damaging to the target application and is not necessary by default since a general default route already exists. ↗
- ·CloudForms Management Engine 5 (cfme package) is listed as 'Not affected' by Red Hat; the vulnerability affects CFME 2.0 and ManageIQ EVM 5.0 and earlier. ↗
CVSS provenance
nvdv2.09.4CRITICALAV:N/AC:L/Au:N/C:N/I:C/A:C
vendor_redhat9.4CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ggp4-2h22-73vm: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2
ghsa_unreviewed·2022-05-17
CVE-2013-2068 [HIGH] CWE-22 GHSA-ggp4-2h22-73vm: Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Red Hat
cfme: CFME 2.0 multiple zip file upload path traversal vulnerabilities
vendor_redhat·2013-09-04·CVSS 9.4
CVE-2013-2068 [CRITICAL] CWE-73 cfme: CFME 2.0 multiple zip file upload path traversal vulnerabilities
cfme: CFME 2.0 multiple zip file upload path traversal vulnerabilities
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Package: cfme (CloudForms Management Engine 5) - Not affected
No detection rules found.
Exploit-DB
RedHat CloudForms Management Engine 5.1 - agent/linuxpkgs Directory Traversal (Metasploit)
exploitdb·2013-12-24
CVE-2013-2068 RedHat CloudForms Management Engine 5.1 - agent/linuxpkgs Directory Traversal (Metasploit)
RedHat CloudForms Management Engine 5.1 - agent/linuxpkgs Directory Traversal (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 'Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal',
'Description' => %q{
This module exploits a path traversal vulnerability in the "linuxpkgs"
action of "agent" controller of the Red Hat CloudForms Management Engine 5.1
(ManageIQ Enterprise Virtualization Manager 5.0 and earlier).
It uploads a fake controller to the controllers directory of the Rails
application with the encoded payload as an action and sends a request to
this action to execute the payload. Optionally, it can also upload a routing
f
Metasploit
Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
metasploit
Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
This module exploits a path traversal vulnerability in the "linuxpkgs" action of "agent" controller of the Red Hat CloudForms Management Engine 5.1 (ManageIQ Enterprise Virtualization Manager 5.0 and earlier). It uploads a fake controller to the controllers directory of the Rails application with the encoded payload as an action and sends a request to this action to execute the payload. Optionally, it can also upload a routing file containing a route to the action. (Which is not necessary, since the application already contains a general default route.)
2013-09-28
Published