Description
An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Exhibitor | Tested version was compiled using the standalone pom.xml from the Exhibitor master branch | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Exhibitor Web UI 1.7.1 - Remote Code Execution EDB-48654 · webapps · Jul 7, 2020
GitHub 2 repositories
-
thehunt1s0n/Exihibitor-RCE ★ 5 · Dec 14, 2023
Exihibitor Web Ui 1.7.1 RCE, CVE-2019-5029
-
yZee00/CVE-2019-5029 ★ 0 · Jan 16, 2025
This is a Python script PoC for CVE-2019-5029
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.