CVE-2013-2474

published 2020-01-27

CVE-2013-2474: Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter.

Priority P2 61 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Directory traversal vulnerability in AWS XMS 2.5 allows remote attackers to view arbitrary files via the 'what' parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
aws-dms	aws_xms	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://[host]/importer.php?what=defaults.php%00.js↗

url http://[host]/importer.php?what=defaults.php///////...//////.js↗

path /importer.php↗

• → Monitor HTTP GET requests to /importer.php containing a 'what' parameter with path traversal patterns, including null-byte injection (%00) or excessive forward slashes (4096+) used to bypass extension restrictions. ↗
• → Detect null-byte injection attempts in the 'what' parameter: look for '%00' in requests to /importer.php (effective against PHP versions prior to 5.3.4). ↗
• → Detect path normalization bypass attempts: look for requests to /importer.php where the 'what' parameter contains a large sequence of '/' characters (4096 is sufficient for the majority of platforms) followed by a .js extension. ↗
• → Responses from /importer.php will carry a 'text/javascript' Content-Type header even when serving arbitrary file contents — correlate this with anomalous request patterns to identify exploitation. ↗

• · Null-byte injection (%00) bypass is only effective against PHP versions prior to 5.3.4 or when 'magic_quotes_gpc' is enabled; path normalization/length restriction bypass (excessive '/' characters) is the alternative technique for patched PHP versions. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22