Vulnerability · Published Jun 27, 2024 · Assigned by VulnCheck
CVE-2024-6127BC Security Empire Path Traversal RCE
Critical 9.8
In plain English
A critical-severity path traversal in Empire from BC Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.3% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BC Security | Empire | 0 – before 5.9.3 |
Weakness: CWE-22, CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://aceresponder.com/blog/exploiting-empire-c2-framework technical-description
- https://github.com/ACE-Responder/Empire-C2-RCE-PoC exploit
- https://github.com/BC-SECURITY/Empire/blob/8283bbc77250232eb493bf1f9104fdd0d468962a/CHANGELOG.md?plain=1#L102 vendor-advisory
- https://vulncheck.com/advisories/empire-unauth-rce third-party-advisory