File tree Expand file tree Collapse file tree 1 file changed +10
-1
lines changed Expand file tree Collapse file tree 1 file changed +10
-1
lines changed Original file line number Diff line number Diff line change @@ -14,7 +14,16 @@ def initialize(info = {})
14
14
super ( update_info ( info ,
15
15
'Name' => 'tnftp "savefile" Arbitrary Command Execution' ,
16
16
'Description' => %q{
17
- This module exploits a vulnerability.
17
+ This module exploits an arbitrary command execution vulnerability in
18
+ tnftp's handling of the resolved output filename - called "savefile" in
19
+ the source - from a requested resource.
20
+
21
+ If tnftp is executed without the -o command-line option, it will resolve
22
+ the output filename from the last component of the requested resource.
23
+
24
+ If the output filename begins with a "|" character, tnftp will pass the
25
+ fetched resource's output to the command directly following the "|"
26
+ character through the use of the popen() function.
18
27
} ,
19
28
'Author' => [
20
29
'Jared McNeill' , # Vulnerability discovery
You can’t perform that action at this time.
0 commit comments