HP PCM+ SNAC Registration Server UpdateDomainControllerServlet Remote Code Execution Vulnerability

September 11th, 2013
ZDI-13-226 ZDI-CAN-1743

CVE ID

CVE-2013-4811

CVSS Score

10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected Vendors

Hewlett-Packard

Affected Products

PCM Plus

Vulnerability Details


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP PCM Plus. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UpdateDomainControllerServlet. This servlet improperly sanitizes the 'adCert' argument allowing the remote attacker could upload a .jsp file. This can result in remote code execution under the context of the SYSTEM user.

Additional Details

Disclosure Timeline

  • 2013-02-15 - Vulnerability reported to vendor
  • 2013-09-11 - Coordinated public release of advisory

Credit

Andrea Micalizzi aka rgod

Back to Advisories