Insecure Permissions on rConfig Server by RConfig
CVE-2021-29005
8.8HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2021-29005?
The rConfig server version 3.9.6 presents a security issue due to incorrect permissions on the chmod command, which can be exploited by an unauthorized user. After the rConfig installation, the Apache user may execute the chmod command with root privileges without requiring a password. This vulnerability can allow attackers with low privilege to escalate their access to root level, posing significant security risks to the server environment.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.