AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 1.2%
from disclosure to weapon0 days
Published on NVDAug 8
metasploitApr 4
exploitation probability
1.2%top 36% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
AjaXplorer · AjaXplorerpublic PoCs found — 2
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rbunverifiedcve_referencewww.exploit-db.com/exploits/21993unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rbhttps://sourceforge.net/projects/ajaxplorer/https://www.exploit-db.com/exploits/21993https://www.tenable.com/plugins/nessus/45489https://www.vulncheck.com/advisories/ajaxplorer-unauth-rce