module
Imperva SecureSphere PWS Command Injection
| Disclosed |
|---|
| Oct 8, 2018 |
Disclosed
Oct 8, 2018
Description
This module exploits a command injection vulnerability in Imperva
SecureSphere 13.x. The vulnerability exists in the PWS service,
where Python CGIs didn't properly sanitize user supplied command
parameters and directly passes them to corresponding CLI utility,
leading to command injection. Agent registration credential is
required to exploit SecureSphere in gateway mode.
This module was successfully tested on Imperva SecureSphere 13.0/13.1/
13.2 in pre-ftl mode and unsealed gateway mode.
SecureSphere 13.x. The vulnerability exists in the PWS service,
where Python CGIs didn't properly sanitize user supplied command
parameters and directly passes them to corresponding CLI utility,
leading to command injection. Agent registration credential is
required to exploit SecureSphere in gateway mode.
This module was successfully tested on Imperva SecureSphere 13.0/13.1/
13.2 in pre-ftl mode and unsealed gateway mode.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.