Arbitrary Code Execution Vulnerability in Symantec Web Gateway Management Console

CVE-2015-5692

Summary

The Symantec Web Gateway appliances have a security loophole in the management console that allows remote authenticated users to execute arbitrary code. This is achieved through a vulnerable component, admin_messages.php, which improperly handles file uploads. Users can exploit this vulnerability by uploading a file with a seemingly safe extension and content type, resulting in the file becoming a setuid-root executable due to weak Sudo configurations. This poses a significant risk of unauthorized control over the system.

References