Description
Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Minishare 1.4.1 Buffer Overflow
exploit/windows/http/minishare_get_overflow
Exploit-DB 3
- MiniShare 1.4.1 - Remote Buffer Overflow (Metasploit) EDB-16754 · remote · May 9, 2010 · verified
- MiniShare 1.4.1 - Remote Buffer Overflow (2) EDB-636 · remote · Nov 16, 2004 · verified
- MiniShare 1.4.1 - Remote Buffer Overflow (1) EDB-616 · remote · Nov 7, 2004 · verified
GitHub 4 repositories
-
kkirsche/CVE-2004-2271 ★ 4 · Jan 17, 2018
Minishare 1.4.1 Remote Buffer Overflow
-
pwncone/CVE-2004-2271-MiniShare-1.4.1-BOF ★ 0 · Feb 2, 2020
A python implementation of CVE-2004-2271 targeting MiniShare 1.4.1.
-
war4uthor/CVE-2004-2271 ★ 0 · Dec 19, 2018
CVE-2004-2271 - Minishare 1.4.1 HTTP Server Remote Buffer Overflow Vulnerability. Tested on Windows XP Professional SP3.
-
PercussiveElbow/CVE-2004-2271-MiniShare-1.4.1-Buffer-Overflow ★ 0 · Jul 25, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 11530 vdb-entry
- minishare-address-link-bo(17978) vdb-entry
- http://www.securiteam.com/exploits/6X00B1PBPC.html
- 11620 vdb-entry
- 13114 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=241158
- 1012106 vdb-entry
- 20041107 [New VULNERABILTY + Exploit] MiniShare, Minimal HTTP Server for Windows, Remote Buffer Overflow Exploit mailing-list