### Overview
Freewill Solutions IFIS new trading web application version 20.01.01.04 is vulnerable to unauthenticated remote code execution. Successful exploitation of this vulnerability allows an attacker to run arbitrary shell commands on the affected host.
### Description
Freewill Solutions IFIS new trading web application passes a user controlled variable directly to a shell_exec function call on a specific report page. To exploit the vulnerability, an attacker can add shell meta characters to the user controlled variable so that the application executes attacker specified commands.
### Impact
An attacker with access to the applications web interface can execute code on the remote host. This level of access allows for complete compromise of the affected machine.
### Solution
The CERT/CC is currently unaware of a practical solution to this problem.
### Acknowledgements
Thanks to Sameer Mohite (Mandiant) for reporting the vulnerability.
This document was written by Kevin Stephens.
### Vendor Information
947701
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
### Freewill Solutions Unknown
Notified: 2023-05-01 Updated: 2023-08-07 **VU#947701.1**| Unknown
—|—
#### Vendor Statement
We have not received a statement from the vendor.
### Other Information
**API URL: ** | VINCE JSON | CSAF
—|—
**Date Public:** | 2023-08-07
**Date First Published:** | 2023-08-07
**Date Last Updated: ** | 2023-08-07 15:57 UTC
**Document Revision: ** | 1Read More
References
Back to Main