The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.
References
Link | Resource |
---|---|
https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85 | Exploit Third Party Advisory |
https://github.com/raspberrytorte/tortoise/tree/master/nodejs | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-07-23T19:46:41
Updated: 2020-07-23T19:46:41
Reserved: 2020-07-01T00:00:00
Link: CVE-2020-15477
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-07-23T20:15:11.693
Modified: 2021-07-21T11:39:23.747
Link: CVE-2020-15477
JSON object: View
Redhat Information
No data.
CWE