module
NFR Agent SRS Record Arbitrary Remote File Access
Disclosed | Created |
---|---|
Nov 16, 2012 | May 30, 2018 |
Disclosed
Nov 16, 2012
Created
May 30, 2018
Description
NFRAgent.exe, a component of Novell File Reporter (NFR), allows remote attackers to retrieve
arbitrary files via a request to /FSF/CMD with a SRS Record with OPERATION 4 and
CMD 103, specifying a full pathname. This module has been tested successfully
against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File
Reporter 1.0.1).
arbitrary files via a request to /FSF/CMD with a SRS Record with OPERATION 4 and
CMD 103, specifying a full pathname. This module has been tested successfully
against NFR Agent 1.0.4.3 (File Reporter 1.0.2) and NFR Agent 1.0.3.22 (File
Reporter 1.0.1).
Author
juan vazquez juan.vazquez@metasploit.com
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.