CVE-2013-2367
published 2013-07-31CVE-2013-2367: Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors…
PriorityP275critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
68.89%
99.4th percentile
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | sitescope | — | — |
| hp | sitescope | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on HTTP responses containing the 'Apache-Coyote' server banner from HP SiteScope, as the exploit fingerprints this header to confirm a valid target before exploitation ↗
- →Monitor for execution of cscript.exe or WScript.Shell spawning cmd.exe on HP SiteScope Windows hosts, which is the injection chain triggered by the vulnerable opcactivate.vbs script ↗
- →The exploit uses a VBS base64 cmdstager with a line-max of 1500 characters; look for large, chunked VBS payloads delivered over SOAP to the SiteScope service ↗
- ·Exploitation requires the optional HP Operations Agent component to be installed alongside HP SiteScope, as the vulnerable opcactivate.vbs script is only present when this component is deployed ↗
- ·The exploit has only been validated against HP SiteScope 11.20 with HP Operations Agent on Windows 2003 SP2; applicability to other OS/version combinations is unconfirmed ↗
- ·The vulnerability is triggered via SOAP; blocking or restricting unauthenticated access to the APIBSMIntegrationImpl AXIS service endpoint is a key mitigation surface ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP SiteScope (Windows) - Remote Code Execution (Metasploit)
exploitdb·2013-09-10
CVE-2013-2367 HP SiteScope (Windows) - Remote Code Execution (Metasploit)
HP SiteScope (Windows) - Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 [ /Apache-Coyote/ ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStagerVBS
def initialize(info = {})
super(update_info(info,
'Name' => 'HP SiteScope Remote Code Execution',
'Description' => %q{
This module exploits a code execution flaw in HP SiteScope.
The vulnerability exists on the opcactivate.vbs script, which
is reachable from the APIBSMIntegrationImpl AXIS service, and
uses WScript.Shell.run() to execute cmd.exe with user pr
Metasploit
HP SiteScope Remote Code Execution
metasploit
HP SiteScope Remote Code Execution
HP SiteScope Remote Code Execution
This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the opcactivate.vbs script, which is reachable from the APIBSMIntegrationImpl AXIS service, and uses WScript.Shell.run() to execute cmd.exe with user provided data. Note that the opcactivate.vbs component is installed with the (optional) HP Operations Agent component. The module has been tested successfully on HP SiteScope 11.20 (with HP Operations Agent) over Windows 2003 SP2.
No writeups or analysis indexed.
2013-07-31
Published