Overview
NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability (CWE-94).
Description
CWE-94: Improper Control of Generation of Code ('Code Injection') NAS4Free version 9.1.0.1.804 and possibly earlier versions contain a remote code execution vulnerability. NAS4Free allows an authenticated user to post PHP code to an HTTP script and have the code executed remotely. By default, NAS4Free runs with root privileges. A remotely authenticated attacker can send an HTTP POST request that contains a malicious PHP file which can cause the script to run directly on the machine. |
Impact
A remote authenticated attacker may be able to execute arbitrary code as root on the system. |
Solution
We are currently unaware of a practical solution to this problem. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 6 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| Temporal | 5.1 | E:POC/RL:U/RC:UR |
| Environmental | 1.3 | CDP:ND/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to Tod Beardsley and Brandon Perry of Rapid7, Inc. for reporting this vulnerability.
This document was written by Adam Rauf.
Other Information
| CVE IDs: | CVE-2013-3631 |
| Date Public: | 2013-10-30 |
| Date First Published: | 2013-10-30 |
| Date Last Updated: | 2013-10-30 17:13 UTC |
| Document Revision: | 28 |