CriticalPublic exploit

Remote Command Injection in Narcissus backend.php

IdentifiersCVE-2012-10033CWE-78· Improper Neutralization of Special…

CVE-2012-10033 is a remote code execution vulnerability in Narcissus caused by improper input handling in its image configuration workflow. The vulnerable path is in backend.php, which fails to sanitize the POST-supplied release parameter before passing it to the configure_image() function. That function subsequently invokes PHP's passthru() with attacker-controlled input. Because the input is not properly neutralized before being used in an OS command context, an attacker can supply crafted data to inject and execute arbitrary system commands on the underlying host. Exploitation is performed through a crafted POST request and results in command execution in the security context of the web server process.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the server hosting Narcissus. The resulting impact depends on the privileges of the web server account, but can include full compromise of the application instance, unauthorized modification of generated images or server-side data, access to sensitive files readable by the web server, installation of additional tooling or malware, and use of the affected host as a pivot point for further intrusion. At minimum, the issue enables arbitrary command execution under the web server's context.

Mitigation

If you can’t patch tonight, do this now.

As an interim mitigation, restrict network access to the vulnerable Narcissus interface so that backend.php is not reachable by untrusted users. Require authentication and administrative access controls for image configuration functionality if possible. Deploy web application firewall rules or reverse-proxy filtering to block suspicious POST requests containing shell metacharacters in the release parameter. Monitor web server and application logs for anomalous requests to backend.php and signs of command execution. Run the web server with the least privileges possible and isolate the application host to reduce post-exploitation impact.

Remediation

Patch, then assume compromise.

Remediate by updating Narcissus to a version in which the release parameter is properly validated and no attacker-controlled data is passed unsafely into shell execution functions. The vulnerable code path in backend.php and configure_image() should be changed to eliminate direct use of passthru() with unsanitized input. Where command execution is required, use strict allowlisting for acceptable release values, enforce server-side input validation, and invoke system commands without a shell where possible. If shell invocation cannot be avoided, apply robust escaping appropriate to the execution context and refactor to use safer APIs.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

narcissus_backend_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (Ruby file) that exploits a remote code execution vulnerability (CVE-2012-10033) in the Narcissus web application's backend.php script. The vulnerability arises from improper handling of the 'release' POST parameter, which is passed unsanitized to a PHP passthru() call, allowing attackers to inject and execute arbitrary system commands. The module is weaponized and leverages Metasploit's payload system to deliver a variety of command-based payloads (e.g., reverse shell, bind shell) using the 'release' parameter. The main attack vector is a network-based HTTP POST request to the backend.php endpoint, typically located at /narcissus-master/backend.php, but configurable via the TARGETURI option. The exploit checks for vulnerability by sending a benign command and looking for its output in the response. If vulnerable, it sends the actual payload for code execution. The module is suitable for targeting Linux/Unix systems running the vulnerable Narcissus web application. The repository is structured as a single Ruby file compatible with the Metasploit framework, and all exploit logic is contained within this file.

Disclosed Nov 14, 2012rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DistributionDistributionapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

5 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5