bugtraq - FlexPaper <= 2.3.6 Remote Command Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 10 Mar 2019 10:00:05 +0100 (CET)
From: Red Timmy Sec - <redazione@...fault.it>
To: bugtraq@...urityfocus.com
Subject: FlexPaper <= 2.3.6 Remote Command Execution

Description
===========
FlexPaper (https://www.flowpaper.com) is an open source project, released under GPL license, quite widespread over the internet. It provides document viewing functionalities to web clients, mobile and tablet devices. At least until 2014 the component has been actively used by WikiLeaks, when it was discovered to be affected by a XSS vulnerability subsequently patched.

Around one year ago Red Timmy Sec discovered a Remote Command Execution vulnerability on FlexPaper. The vendor was immediately contacted and a CVE registered (2018-11686). However the vulnerability itself has remained undisclosed until now, regardless the fact that a patch has been issued with the release 2.3.7 of the project.

Full analysis of this vulnerability can be found here: https://redtimmysec.wordpress.com/2019/03/07/flexpaper-remote-code-execution/