Description
An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metacharacters, remote attackers can execute arbitrary system commands on the server with the privileges of the web server process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AjaXplorer | AjaXplorer | < 2.6 | 2.6 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
AjaXplorer checkInstall.php Remote Command Execution
exploit/multi/http/ajaxplorer_checkinstall_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://sourceforge.net/projects/ajaxplorer/ product
- https://www.exploit-db.com/exploits/21993 exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb exploit
- https://www.tenable.com/plugins/nessus/45489 third-party-advisory
- https://www.vulncheck.com/advisories/ajaxplorer-unauth-rce third-party-advisory