Attacker Value

Unknown

CVE-2012-0297 Symantec Web Gateway Vulnerability

Attacker Value

Unknown

(1 user assessed)

Exploitability

Unknown

(1 user assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

CVE-2012-0297 Symantec Web Gateway Vulnerability

Disclosure Date: May 21, 2012 •

CVE-2012-0297

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Metasploit Module

exploit/linux/http/symantec_web_gateway_lfi

Description

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.

Add Assessment

wchen-r7 (173)

September 12, 2019 6:07pm UTC (5 years ago)•Edited 4 years ago

Technical Analysis

—\” >> logging”);
exec(“echo \“route >> logging\” >> networkScript”);
echo “executing script<br/>”;
exec(“./networkScript”);
?>
</body>
</html>


Analysis of the command injection

echo “ifconfig eth0 netmask “. \(HTTP_POST_VARS["subnet"] ." ". \)HTTP_POST_VARS[“ip”] .“;” >> networkScript

“;” + payload.encoded + “;#”


**/spywall/network.php**

```php
<?php

require_once('includes/spywall_api.php');
/*
$wan = 'eth0';
$lan = 'eth1';
$management = 'eth2';
$mon = 'eth3';
$savename = '';

$model = exec('cat /tmp/appliancemodel');
if ($model == '007' || $model == '009') {
	// different ethernet device numbers for these models
	$management = 'eth0';
	$mon = 'eth3';
	$wan = 'eth5';
	$lan = 'eth6';
}
*/
$portMap = getPortMap();
$management = $portMap['mgmt'];
$mon = $portMap['monitor'];
$wan = $portMap['wan'];
$lan = $portMap['lan'];

$device = '';
if ($_POST['name'] == 'lan') {
	$device = $lan;
	$savename = 'LAN';
} else if ($_POST['name'] == 'wan') {
	$device = $wan;
	$savename = 'WAN';
} else if ($_POST['name'] == 'monitor') {
	$device = $mon;
	$savename = 'MON';
} else {
	$device = $management;
	$savename = 'MAN';
}

if (strlen($device)) {
	// set autonegotiation, duplex (if it isn't set to unknown),
	// and speed (if it isn't set to unknown)
	exec("sudo /sbin/ethtool -s $device autoneg ". $_POST['auto'] .((isset($_POST['duplex']) && $_POST['duplex'] != 'unknown')?(" duplex ". $_POST['duplex']):'') .((isset($_POST['speed']) && $_POST['speed'] != 'unknown')?(" speed ". $_POST['speed']):''));

        exec("sudo /bin/rm -f /home/admin/autoconfig". $savename);
	// save info to autoconfig file
	exec("echo \"/sbin/ethtool -s $device autoneg ". $_POST['auto'] .((isset($_POST['duplex']) && $_POST['duplex'] != 'unknown')?(" duplex ". $_POST['duplex']):'') .((isset($_POST['speed']) && $_POST['speed'] != 'unknown')?(" speed ". $_POST['speed']):'') ."\" > /home/admin/autoconfig". $savename);
//	echo "\"/sbin/ethtool -s $device autoneg ". $_POST['auto'] .(($_POST['duplex'] != 'unknown')?(" duplex ". $_POST['duplex']):'') .(($_POST['speed'] != 'unknown')?(" speed ". $_POST['speed']):'') ."\" > /home/admin/autoconfig". $savename;
	sleep(5);	// we sleep because otherwise we get back before the changes take effect
}

?>
<script language="javascript"> window.location="admin_advanced.php";</script>

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Unknown

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

symantec

Products

Metasploit Modules

exploit/linux/http/symantec_web_gateway_lfi (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/symantec_web_gateway_lfi.rb)

References

Rapid7

Unknown