CVE-2014-8741
published 2020-01-27CVE-2014-8741: Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
77.20%
99.5th percentile
Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark MarkVision Enterprise before 2.1 allows remote attackers to write to arbitrary files via unspecified vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| lexmark | markvision_enterprise | < 2.1 | 2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated HTTP POST requests to the /mve/upload/gfd endpoint, which corresponds to the vulnerable GfdFileUploadServlet servlet used for directory traversal file upload. ↗
- →Detect multipart/form-data POST requests to /mve/upload/gfd on port 9788 as a strong indicator of exploitation attempts. ↗
- →Alert on HTTP GET requests to newly uploaded JSP files on the server root following a POST to /mve/upload/gfd, indicating successful payload staging and execution. ↗
- →Check HTTP responses from /mve/help/en/inventory/am_about.html for the string 'MarkVision Enterprise' followed by a version number to identify vulnerable instances being fingerprinted by attackers. ↗
- ·The exploit targets Lexmark MarkVision Enterprise versions before 2.1 only; version 2.1 and later are not affected. Fingerprinting via the version check endpoint should be used to confirm exposure. ↗
- ·The Metasploit module targets the Windows platform (tested on Windows 2003 SP2) with a Java architecture payload; detection rules should account for JSP webshell uploads on Windows-hosted deployments. ↗
- ·The default TARGETURI is '/', meaning the attack paths (/mve/upload/gfd, /mve/help/en/inventory/am_about.html) are relative to the root and may vary if the application is deployed under a non-root context path. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
exploitdb·2015-01-13
CVE-2014-8741 Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
Lexmark MarkVision Enterprise - Arbitrary File Upload (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Lexmark MarkVision Enterprise Arbitrary File Upload',
'Description' => %q{
This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1.
A directory traversal in the GfdFileUploadServlet servlet allows an unauthenticated
attacker to upload arbitrary files, including arbitrary JSP code. This module has been
tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2.
},
'Author' =>
[
'Andrea Micalizzi', # Vulnerability Discovery
'juan vazquez' # Metasploit module
],
'License' => MSF_LICENSE,
'Referenc
Metasploit
Lexmark MarkVision Enterprise Arbitrary File Upload
metasploit
Lexmark MarkVision Enterprise Arbitrary File Upload
Lexmark MarkVision Enterprise Arbitrary File Upload
This module exploits a code execution flaw in Lexmark MarkVision Enterprise before version 2.1. A directory traversal vulnerability in the GfdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2.
No writeups or analysis indexed.
2020-01-27
Published