Immunity CanvasRCONFIG_AJAXSERVER_RCEImmunity Canvas: RCONFIG_AJAXSERVER_RCE
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
| Name | rconfig_ajaxserver_rce |
|---|---|
| CVE | CVE-2019-16662 Exploit Pack |
| VENDOR: rConfig | |
| NOTES: |
The current exploit initializes a tcp server to serve the mosdef callback (port 8080)
IMPORTANT: In the path textfield you need the path to the rConfig webapp.
Tested on:
- CentOS7, rConfig v3.9.2
Repeatability: Infinite
References: https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/unpatched-remote-code-execution-rconfig-flaws-could-affect-millions-of-servers-and-network-devices
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-16662
Date public: 21/09/2019
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C