critical9.8Public exploit code
CVE-2017-14143
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Kaltura - Remote PHP Code Execution over Cookie (Metasploit)2018-01-24 · remote · php · Verified
- Kaltura < 13.2.0 - Remote Code Execution2017-10-23 · webapps · php · Verified
Impact
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kaltura | Kaltura Server | through mercury-13.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/100976
- https://github.com/kaltura/server/commit/6a6d14328b7a1493e8c47f9565461e5f88be20c9#diff-0770640cc76112cbf77bebc604852682
- https://telekomsecurity.github.io/assets/advisories/20170912_kaltura-advisory.txt
- https://www.exploit-db.com/exploits/43028/
- https://www.exploit-db.com/exploits/43876/
- http://www.securityfocus.com/bid/100976
- https://github.com/kaltura/server/commit/6a6d14328b7a1493e8c47f9565461e5f88be20c9#diff-0770640cc76112cbf77bebc604852682
- https://telekomsecurity.github.io/assets/advisories/20170912_kaltura-advisory.txt
- https://www.exploit-db.com/exploits/43028/
- https://www.exploit-db.com/exploits/43876/