CVE-2015-3203

published 2015-09-28

CVE-2015-3203: Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable…

Priority P2 60 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

Unrestricted file upload vulnerability in h5ai before 0.25.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the href parameter.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
h5ai_project	h5ai	<= 0.24.1	—

Detection & IOCs extracted from sources · hover to see the quote

url https://web.archive.org/web/20140208063613/http://release.larsjung.de/h5ai/h5ai-0.24.0.zip↗

command action=upload (POST parameter with multipart form-data boundary ------multipartformboundary1442784669030)↗

• → Detect POST requests to h5ai endpoints containing multipart form-data with action=upload and a file with an executable extension (e.g., .php), combined with the static MIME boundary string 'multipartformboundary1442784669030'. ↗
• → Alert on POST requests carrying the header 'X-Requested-With: XMLHttpRequest' with multipart body containing form fields 'action=upload' and 'href' pointing to a directory path, followed by a GET request to the same path for the uploaded file. ↗
• → Monitor for successful upload of files with executable extensions (e.g., .php) to h5ai-served directories, followed immediately by a direct HTTP GET request to the uploaded file path — indicating exploitation and remote code execution attempt. ↗
• → Flag the specific exploit User-Agent string 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0' appearing alongside h5ai upload POST requests as a low-confidence indicator of this specific exploit script. ↗

• · The vulnerability affects h5ai versions 0.22.0 through 0.24.1 only; version 0.25.0 and later are patched. Scope detection rules to servers running these specific versions. ↗
• · The exploit was tested on h5ai 0.24.0 running on Apache; behavior on other web servers (nginx, IIS, etc.) may differ and the upload endpoint path may vary by deployment. ↗
• · The MIME boundary 'multipartformboundary1442784669030' is a hardcoded constant in this specific exploit script; other exploit variants or manual exploitation may use different boundary strings, so boundary-based detection alone is insufficient. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.