CVE-2017-6087 in EyesOfNetwork
Summary
by MITRE
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2025
The CVE-2017-6087 vulnerability affects EyesOfNetwork version 5.0 and earlier, representing a critical remote code execution flaw that enables authenticated attackers to gain unauthorized system access. This vulnerability resides within the monitoring and event management functionality of the platform, specifically targeting the handling of user-supplied parameters in multiple functions. The flaw manifests when the application fails to properly sanitize user input before processing it in shell contexts, creating a dangerous attack surface for privilege escalation and system compromise.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the ged_functions.php file, where the selected_events[] parameter is processed without adequate filtering. When authenticated users submit malicious shell metacharacters through this parameter, the application executes these commands in the underlying operating system shell, bypassing normal access controls and authorization mechanisms. The vulnerability affects four distinct functions including acknowledge, delete, ownDisown operations within the monitoring_ged module, as well as the module parameter handling in the main index.php file, demonstrating a widespread impact across the application's core functionality.
The operational impact of CVE-2017-6087 is severe and multifaceted, potentially allowing attackers to execute arbitrary commands with the privileges of the web application user. This capability enables attackers to escalate privileges, access sensitive data, modify system configurations, and potentially establish persistent backdoors within the network monitoring infrastructure. Given that EyesOfNetwork is designed for network security monitoring and event management, successful exploitation could provide adversaries with complete visibility into network traffic and security events, effectively compromising the integrity and confidentiality of the entire monitoring environment. The vulnerability's authentication requirement does not mitigate its severity since authorized users with limited privileges could leverage this flaw to gain elevated system access.
This vulnerability aligns with CWE-78, which describes improper neutralization of special elements used in OS commands, and corresponds to attack techniques in the MITRE ATT&CK framework under T1059.001 for Command and Scripting Interpreter. Organizations should implement immediate mitigations including applying the vendor-provided patches, implementing input validation and sanitization measures, and restricting unnecessary authentication privileges. Network segmentation and monitoring of suspicious command execution patterns should be implemented as additional defensive measures to detect potential exploitation attempts and limit lateral movement within compromised environments.