Narcissus backend.php Image Configuration Command Injection
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 1.2%
from disclosure to weapon0 days
Published on NVDAug 5
metasploitNov 14
exploitation probability
1.2%top 35% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Ångström Distribution Project · Narcissuspublic PoCs found — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rbunverifiedcve_referencewww.exploit-db.com/exploits/22709unverifiedcve_referencewww.exploit-db.com/exploits/22856unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/narcissus_backend_exec.rbhttps://web.archive.org/web/20101127002623/https://narcissus.angstrom-distribution.org/https://www.exploit-db.com/exploits/22709https://www.exploit-db.com/exploits/22856https://www.vulncheck.com/advisories/narcissus-image-config-command-injection