CVE-2014-8517

The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

69.12% chance of exploitation in the next 30 days, 99th percentile

Published

2014-11-17

Updated

2024-08-06

Proof-of-concept exploits (1)

• c0decave/Exploits1★ · 2019-07-11

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/tnftp_savefile.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/43112
• https://www.exploit-db.com/exploits/35427

References

• CVE Record
• NVD entry

Related

• CVE-2017-8779
• CVE-2014-8516
• CVE-2014-8555
• CVE-2014-8507
• CVE-2014-8577
• CVE-2014-8499