FreeNAS 0.7.2 prior to revision 5543 contains an unauthenticated command-execution backdoor in its web interface. The exec_raw.php script allows the cmd parameter to be passed directly to the underlying shell without any sanitation, leading to potential exploitation. This vulnerability poses significant risks to confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2010-20059 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted request to the FreeNAS web interface, specifically targeting the exec_raw.php script. By manipulating the cmd parameter, the attacker can execute arbitrary commands on the underlying system without authentication, leading to unauthorized access and control.
Affected Products
- FreeNAS 0.7.2: This version is vulnerable due to the presence of the exec_raw.php script that allows command execution without proper validation.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to a later version of FreeNAS that addresses this issue. Additionally, implementing network security measures such as firewalls and access controls can help limit exposure to this vulnerability.