Rapid7 Vulnerability & Exploit Database

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

Back to Search

WatchGuard XTM Firebox Unauthenticated Remote Command Execution

Disclosed
08/29/2022
Created
03/28/2024

Description

This module exploits a buffer overflow at the administration interface (8080 or 4117) of WatchGuard Firebox and XTM appliances which is built from a cherrypy python backend sending XML-RPC requests to a C binary called wgagent using pre-authentication endpoint /agent/login. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2. Successful exploitation results in remote code execution as user nobody.

Author(s)

  • h00die-gr3y <h00die.gr3y@gmail.com>
  • Charles Fol (Ambionics Security)
  • Dylan Pindur (AssetNote)
  • Misterxid

Platform

Unix

Architectures

cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/watchguard_firebox_unauth_rce_cve_2022_26318
msf exploit(watchguard_firebox_unauth_rce_cve_2022_26318) > show targets
    ...targets...
msf exploit(watchguard_firebox_unauth_rce_cve_2022_26318) > set TARGET < target-id >
msf exploit(watchguard_firebox_unauth_rce_cve_2022_26318) > show options
    ...show and set options...
msf exploit(watchguard_firebox_unauth_rce_cve_2022_26318) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;