HTTP: Command Injection Detected on HTTP User Agent Header

This signature detects specific characters, typically used in command injection, within an HTTP connection. Because these characters are not normally used in HTTP, this can indicate a command injection attack through a procedure. However, it can be a false positive.

Extended Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.

References

BugTraq: 102212

CVE: CVE-2017-17411

URL: https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair

Short Name

HTTP:USER-AGENT-CMD-INJ

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Command Injection Detected on HTTP User Agent Header

Extended Description

References

Found a potential security threat?