Description
FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
iXsystems FreeNAS
Default version status: unaffected
0 to < 0.7.2 rev 5543affected
References
- https://www.exploit-db.com/exploits/16313 ↗
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/freenas_exec_raw.rb ↗
- https://sourceforge.net/projects/freenas/ ↗
- https://github.com/freenas ↗
- https://www.truenas.com/freenas/ ↗
- https://www.tenable.com/plugins/nnm/5714 ↗
- https://web.archive.org/web/20101218143110/http://sourceforge.net/projects/freenas/files//stable/0.7.2/NOTES%200.7.2.5543.txt/view ↗
- https://www.vulncheck.com/advisories/freenas-arbitrary-command-execution ↗