Command Injection Vulnerability in Exhibitor Web UI by Netflix
CVE-2019-5029
Key Information:
- Vendor
- Exhibitor Project
- Status
- Exhibitor
- Vendor
- CVE Published:
- 13 November 2019
Badges
Summary
A command injection vulnerability exists in the Config editor of the Exhibitor Web UI, allowing attackers to insert and execute arbitrary shell commands. When commands are enclosed in backticks or the $() construct, they can be executed by the Exhibitor process upon launching ZooKeeper. This poses a significant risk, as the commands run with the same privileges as the Exhibitor user, enabling potential exploitation.
Affected Version(s)
Exhibitor Tested version was compiled using the standalone pom.xml from the Exhibitor master branch
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
87% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved