CVE-2020-7209
published 2020-02-13CVE-2020-7209: LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
98.85%
99.9th percentile
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hp | linuxki | < 6.0-2 | 6.0-2 |
| hp | linuxki | — | — |
Detection & IOCsextracted from sources · hover to see the quote
path/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;↗
- →The vulnerable parameter is 'pid' in kivis.php; attacker-controlled shell metacharacters (semicolons) are passed directly to shell_exec(). Monitor HTTP GET requests to /linuxki/experimental/vis/kivis.php containing semicolons or command separators in the 'pid' parameter. ↗
- →Exploit traffic uses HTTP GET with type=kitrace and a pid value containing shell command injection (e.g., pid=0;echo START;...;echo END;). Alert on URL-encoded semicolons (%3B) or literal semicolons in the pid query parameter of kivis.php. ↗
- →Nuclei template uses a regex match on 'root:.*:0:0:' in the HTTP response body to confirm successful /etc/passwd exfiltration via the RCE. Detect responses from kivis.php containing passwd-file patterns as evidence of exploitation. ↗
- ·The vulnerability affects LinuxKI v6.0-1 and earlier only; v6.0-2 is patched. Ensure version detection is part of any scanning or triage workflow. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4p9q-r6vf-q2pr: LinuxKI v6
ghsa_unreviewed·2022-05-24
CVE-2020-7209 [HIGH] GHSA-4p9q-r6vf-q2pr: LinuxKI v6
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
VulnCheck
LinuxKI Toolset 6.0-1 Remote Code Execution
vulncheck·2020·CVSS 9.8
CVE-2020-7209 [CRITICAL] LinuxKI Toolset 6.0-1 Remote Code Execution
LinuxKI Toolset 6.0-1 Remote Code Execution
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
Affected: HP linuxki
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/; https://cujo.com/blog/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/; https://cujo.com/the-2022-2023-iot-botnet-report-vulnerabilities-targeted/; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2020-7209; https://dashboard.shadowserver.org/statistic
No detection rules found.
Exploit-DB
HP LinuxKI 6.01 - Remote Command Injection
exploitdb·2020-05-18·CVSS 9.8
CVE-2020-7209 [CRITICAL] HP LinuxKI 6.01 - Remote Command Injection
HP LinuxKI 6.01 - Remote Command Injection
---
Exploit Title: HP LinuxKI 6.01 - Remote Command Injection
Date: 2020-05-17
Exploit Author: Cody Winkler
Vendor Homepage: https://www.hpe.com/us/en/home.html
Software Link: https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-1
Version: <= v6.0-1
Tested on: LinuxKI Docker Image
CVE: CVE-2020-7209
#!/usr/bin/env python3
import requests
import argparse
import sys
import re
def parse_options():
formatter = lambda prog: argparse.HelpFormatter(prog,max_help_position=50)
parser = argparse.ArgumentParser(description='HP LinuxKI <= 6.0-1 RCE - CVE-2020-7209', formatter_class=formatter)
parser.add_argument("-i", "--ip", dest='host', type=str, help="Target Hostname/IP", required=True)
parser.add_argument("-p", "--port", dest='port', type=str
Nuclei
LinuxKI Toolset <= 6.01 - Remote Command Execution
nuclei·CVSS 9.8
CVE-2020-7209 [CRITICAL] LinuxKI Toolset <= 6.01 - Remote Command Execution
LinuxKI Toolset <= 6.01 - Remote Command Execution
LinuxKI v6.0-1 and earlier are vulnerable to remote code execution.
Template:
id: CVE-2020-7209
info:
name: LinuxKI Toolset <= 6.01 - Remote Command Execution
author: dwisiswant0
severity: critical
description: LinuxKI v6.0-1 and earlier are vulnerable to remote code execution.
impact: |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
remediation: This is resolved in release 6.0-2.
reference:
- http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.html
- https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2
- https://github.com/H
Metasploit
LinuxKI Toolset 6.01 Remote Command Execution
metasploit
LinuxKI Toolset 6.01 Remote Command Execution
LinuxKI Toolset 6.01 Remote Command Execution
This module exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution. The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.
http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.htmlhttps://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.htmlhttp://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.htmlhttps://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2
2020-02-13
Published
Exploited in the wild