CVE-2013-4837
published 2013-11-04CVE-2013-4837: Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka…
PriorityP273critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
62.62%
99.2th percentile
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | loadrunner | <= 11.51 | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
| hp | loadrunner | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect directory traversal attempts in the copyFileToServer SOAP method by looking for repeated '../' or '..\' sequences in POST bodies to /ServiceEmulation/services/EmulationAdmin. ↗
- →Alert on HTTP POST requests to /ServiceEmulation/services/EmulationAdmin with Content-Type 'text/xml' and an empty SOAPAction header, which is the exploit's characteristic request pattern. ↗
- →Fingerprint the vulnerable service by checking for HTTP GET requests to /ServiceEmulation/services/EmulationAdmin?wsdl=1 returning a WSDL containing 'copyFileToServerRequest', which is the exploit's check method. ↗
- →Monitor for Apache-Coyote/1.1 server banner on port 8080, which is used by the exploit to confirm the target is HP LoadRunner's embedded Tomcat instance. ↗
- →Watch for JSP file uploads (base64-encoded payloads in SOAP in2 element) followed by GET requests to /ServiceEmulation/<jsp_name>, indicating a webshell drop and execution attempt. ↗
- ·The traversal depth is configurable (default 3) and can be brute-forced up to 10 levels; detection rules must account for variable numbers of '../' sequences, not just a fixed depth. ↗
- ·The install path is configurable; the default drop location is C:\Program Files\HP\LoadRunner but attackers may specify a different path, so path-based detections should not rely solely on the default. ↗
- ·The SOAP in0 element uses a randomized session ID (30000 + rand(30000)), so signature rules should not match on a fixed value for this field. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
HP LoadRunner EmulationAdmin - Web Service Directory Traversal (Metasploit)
exploitdb·2013-12-11
CVE-2013-4837 HP LoadRunner EmulationAdmin - Web Service Directory Traversal (Metasploit)
HP LoadRunner EmulationAdmin - Web Service Directory Traversal (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require 'rexml/document'
class Metasploit3 [ /Apache-Coyote\/1\.1/ ] }
include REXML
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info = {})
super(update_info(info,
'Name' => 'HP LoadRunner EmulationAdmin Web Service Directory Traversal',
'Description' => %q{
This module exploits a directory traversal vulnerability on the version 11.52 of HP
LoadRunner. The vulnerability exists on the EmulationAdmin web service, specifically
in the copyFileToServer method, allowing to upload arbitrary files. This module has
b
Metasploit
HP LoadRunner EmulationAdmin Web Service Directory Traversal
metasploit
HP LoadRunner EmulationAdmin Web Service Directory Traversal
HP LoadRunner EmulationAdmin Web Service Directory Traversal
This module exploits a directory traversal vulnerability in version 11.52 of HP LoadRunner. The vulnerability exists in the EmulationAdmin web service, specifically in the copyFileToServer method, allowing the upload of arbitrary files. This module has been tested successfully on HP LoadRunner 11.52 on Windows 2003 SP2.
No writeups or analysis indexed.
2013-11-04
Published