NFR Agent FSFUI Record Arbitrary Remote File Access

2012-11-16T15:03:09
ID MSF:AUXILIARY/SCANNER/HTTP/NOVELL_FILE_REPORTER_FSFUI_FILEACCESS
Type metasploit
Reporter Rapid7
Modified 2020-02-18T15:06:11

Description

NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve arbitrary text files via a directory traversal while handling requests to /FSF/CMD with an FSFUI record with UICMD 126. This module has been tested successfully against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File Reporter 1.0.1).