vulnwire
8.1high

CVE-2017-14705

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted int…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
7.4%
percentile 94%
Public exploits
0
none known

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webservices/stream/tail.php. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706. This affects DenyAll i-Suite LTS 5.5.0 through 5.5.12, i-Suite 5.6, Web Application Firewall 5.7, and Web Application Firewall 6.x before 6.4.1, with On Premises or AWS/Azure cloud deployments.

Exploit prediction (EPSS)

7.36% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • github.com /rapid7/metasploit-framework/pull/8980 · x_refsource_MISC, x_transferred
  • pentest.blog /advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/ · x_refsource_MISC, x_transferred
  • denyall.com /blog/advisories/advisory-unauthenticated-remote-code-execution-denyall-web-application-fi · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.