CVE-2017-7411

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 67%

from disclosure to weapon50 days

Published on NVDOct 30

1st PoC+50d

metasploitOct 23

exploitation probability

67%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).

Affected products

n/a · n/a

public PoCs found — 3✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43374 cve_referencepacketstormsecurity.com/files/144716/Tuleap-9.6-Second-Order-PHP-Object-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/43374/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://karmainsecurity.com/KIS-2017-02 http://packetstormsecurity.com/files/144716/Tuleap-9.6-Second-Order-PHP-Object-Injection.html http://seclists.org/fulldisclosure/2017/Oct/53 https://tuleap.net/plugins/tracker/?aid=10118 https://www.exploit-db.com/exploits/43374/http://www.openwall.com/lists/oss-security/2017/10/23/3