CVE-2013-4835
published 2013-11-04CVE-2013-4835: The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a…
PriorityP277high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
71.00%
99.4th percentile
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
| hp | sitescope | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated POST requests to the APISiteScopeImpl SOAP endpoint targeting the issueSiebelCmd method, which allows arbitrary command execution without credentials. ↗
- →Look for HTTP 500 responses containing the string 'Cmd Error: User and Password must be specified' as a fingerprint of a vulnerable HP SiteScope instance being probed. ↗
- →Inspect SOAP requests for the namespace 'http://Api.freshtech.COM' and the element 'api:issueSiebelCmd' — these are specific to exploit payloads targeting this vulnerability. ↗
- →Server banner matching /Apache-Coyote/ can be used to fingerprint the target as HP SiteScope prior to exploitation. ↗
- ·The default TARGETURI path is '/SiteScope/' but may vary in non-default deployments; detection rules should account for alternate base paths. ↗
- ·The exploit targets both Windows (x86 VBS cmdstager via cmd.exe) and Linux (CMD arch via perl/python/bash-tcp/gawk/openssl payloads); detection should cover both platform variants. ↗
- ·On Linux, the payload avoids characters 0x20 (space), 0x22 ("), 0x27 ('), and 0x3c (<); signatures relying on these characters in the payload body may miss Linux-targeted attacks. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit)
exploitdb·2013-12-24
CVE-2013-4835 HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit)
HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rexml/document'
class Metasploit3 [ /Apache-Coyote/ ] }
include REXML
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStagerVBS
def initialize(info = {})
super(update_info(info,
'Name' => 'HP SiteScope issueSiebelCmd Remote Code Execution',
'Description' => %q{
This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the
APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the
user to execute arbitrary commands without authentication. This module has been tested
successfully
Metasploit
HP SiteScope issueSiebelCmd Remote Code Execution
metasploit
HP SiteScope issueSiebelCmd Remote Code Execution
HP SiteScope issueSiebelCmd Remote Code Execution
This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the user to execute arbitrary commands without authentication. This module has been tested successfully on HP SiteScope 11.20 over Windows 2003 SP2, Windows 2008 and CentOS 6.5.
No writeups or analysis indexed.
http://www.exploit-db.com/exploits/30473https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435http://www.exploit-db.com/exploits/30473https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435
2013-11-04
Published