Accellion FTA - getStatus RCE Detection (CVE-2015-2857)

Detects CVE-2015-2857 by POSTing oauthtoken=';echo ' to /tws/getStatus and matching Success resultmsg. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA oauthtoken command injection CVE-2015-2857.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Accellion FTA - getStatus Command Injection (CVE-2015-2857)

Exploits CVE-2015-2857 by injecting OS commands via oauthtoken on /tws/getStatus. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA getStatus oauthtoken RCE CVE-2015-2857 — opens execute session.""" import re from urllib.parse import quote from...

Authentication flaw

Accellion File Transfer Appliance before FTA911210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauthtoken parameter...

CVE-2015-2857

Accellion File Transfer Appliance before FTA911210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauthtoken parameter...

CVE-2015-2857

Accellion File Transfer Appliance before FTA911210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauthtoken parameter...

CVE-2015-2857

CVE-2015-2857 affects Accellion File Transfer Appliance (FTA) prior to FTA_9_11_210. The vulnerability allows remote code execution via shell metacharacters in the oauth_token parameter, caused by insufficient input sanitization. Public references and sightings indicate exploit tooling exist (e.g...

CVE-2015-2857: Improper Neutralization of Special Elements used in a Command

Accellion File Transfer Appliance before FTA911210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauthtoken parameter...

Accellion FTA getStatus verify_oauth_token Command Execution (CVE-2015-2857)

A command execution vulnerability exists in Accellion File Transfer appliance. The vulnerability is due to insufficient sanitization of the oauthtoken parameter. A remote attacker can exploit this vulnerability by sending crafted request to the affected appliance...

Accellion Secure File Transfer Appliance 'oauth_token' Parameter Remote Command Execution

The remote Accellion Secure File Transfer Appliance is affected by a remote command execution vulnerability due to improper sanitization of user-supplied in put to the 'oauthtoken' parameter in the getoauthcustomername and verifyoauthtoken functions. The parameter is passed to a system command...

Accellion FTA getStatus command injection

Added: 07/16/2015 CVE: CVE-2015-2857 Background The Accellion File Transfer Appliance is a solution for secure file sharing. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands contained in the oauthtoken parameter to the getStatus action. Resolution...