An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter.
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Link | Tags |
---|---|
https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb | third party advisory exploit |