Pluck 4.7.9-dev1 action=installmodule unrestricted upload

Summaryinfo

A vulnerability classified as critical was found in Pluck 4.7.9-dev1. The impacted element is an unknown function. Such manipulation of the argument action=installmodule as part of ZIP Archive leads to unrestricted upload. This vulnerability is listed as CVE-2019-9050. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Pluck 4.7.9-dev1. It has been rated as critical. Affected by this issue is an unknown function. The manipulation of the argument action=installmodule as part of a ZIP Archive leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed.

The bug was discovered 02/19/2019. The weakness was presented 02/23/2019. This vulnerability is handled as CVE-2019-9050 since 02/23/2019. The exploitation is known to be easy. The attack may be launched remotely. The successful exploitation requires a simple authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-131140, VDB-131139, VDB-131137 and VDB-131136 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Pluck

Version

• 4.7.9-dev1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxxx-xxx Xx.x.xx Xxx X Xxxx Xxxx Xxx Xxxxxxxxxxxxx (by xiafine)
• Submit #XXXXXX: Xxxxxxxxx Xxxx Xxxxxx Xxxxxx Xx Xxxxxxxx X.x.xx (by JackYu)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion