CVE-2012-10033: critical vulnerability in Ångström Distribution Project Narcissus
Narcissus backend.php Image Configuration Command Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 2.0%
from disclosure to weaponsame day
Published on NVDAug 5
metasploitNov 14
Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ångström Distribution Project · Narcissuspublic PoCs found — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rbunverifiedcve_referencewww.exploit-db.com/exploits/22709unverifiedcve_referencewww.exploit-db.com/exploits/22856unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rbhttps://web.archive.org/web/20101127002623/https://narcissus.angstrom-distribution.org/https://www.exploit-db.com/exploits/22709https://www.exploit-db.com/exploits/22856https://www.vulncheck.com/advisories/narcissus-image-config-command-injection