NAS4Free version 126.96.36.199.804 and possibly earlier versions contain a remote code execution vulnerability (CWE-94).
CWE-94: Improper Control of Generation of Code ('Code Injection')
NAS4Free version 188.8.131.52.804 and possibly earlier versions contain a remote code execution vulnerability. NAS4Free allows an authenticated user to post PHP code to an HTTP script and have the code executed remotely. By default, NAS4Free runs with root privileges. A remotely authenticated attacker can send an HTTP POST request that contains a malicious PHP file which can cause the script to run directly on the machine.
A remote authenticated attacker may be able to execute arbitrary code as root on the system.
We are currently unaware of a practical solution to this problem.
Thanks to Tod Beardsley and Brandon Perry of Rapid7, Inc. for reporting this vulnerability.
This document was written by Adam Rauf.
|Date First Published:||2013-10-30|
|Date Last Updated:||2013-10-30 17:13 UTC|