QwikSec

Security Database

CVE

CWE

Training

CVE-2017-9807

Published: Jun 22, 2017

Modified: Aug 5, 2024

PUBLISHED

Description

An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code or OS commands via api/saveconfig.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

[oss-security] 20171002 CVE-2017-9807: e2openplugin-OpenWebif: Remote code execution through HTTP GET parameter manipulation

mailing-list

x_refsource_MLIST

https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.