CriticalPublic exploit

Unauthenticated Command Injection in ESVA learn-msg.cgi

IdentifiersCVE-2012-10046CWE-78· Improper Neutralization of Special…

CVE-2012-10046 is an unauthenticated OS command injection vulnerability in the E-Mail Security Virtual Appliance (ESVA), tested on version ESVA_2057. The flaw is present in the learn-msg.cgi script, where the CGI handler does not properly sanitize or neutralize user-controlled input supplied through the id parameter before passing it to the shell or an OS command context. As a result, a remote attacker can append or inject arbitrary shell commands via a crafted request to the vulnerable CGI endpoint and cause those commands to be executed by the underlying operating system.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote code execution on the ESVA appliance. An attacker can execute arbitrary shell commands with the privileges of the vulnerable web/CGI process, which may enable full compromise of the appliance, including modification of system configuration, access to sensitive email or security data handled by the appliance, installation of persistence mechanisms, and use of the host as a pivot point for further activity.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to the ESVA administrative or CGI interface so the vulnerable endpoint is not reachable from untrusted networks. Place the appliance behind a management VPN, firewall, or IP allowlist, and disable or remove access to the learn-msg.cgi functionality if it is not required. Deploy web application firewall rules or reverse-proxy filtering to block metacharacters and anomalous input in the id parameter as a temporary measure, recognizing that such filtering is not a complete substitute for patching. Monitor web and system logs for suspicious requests to learn-msg.cgi and evidence of command execution.

Remediation

Patch, then assume compromise.

Upgrade to a fixed ESVA release if one is available from the vendor. The vulnerable learn-msg.cgi handler should be corrected to avoid invoking shell commands with unsanitized user input and to strictly validate or allowlist the id parameter. If source or vendor patching is available, remove shell interpretation entirely by using safe APIs that do not invoke a command shell and by enforcing server-side input validation. Review the appliance for signs of compromise if it has been exposed.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

esva_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/linux/http/esva_exec.rb) targeting a command injection vulnerability in the E-Mail Security Virtual Appliance (ESVA), specifically version ESVA_2057. The exploit abuses the /cgi-bin/learn-msg.cgi endpoint, which is accessible over HTTP, to inject and execute arbitrary OS commands via the 'id' GET parameter. The module is fully integrated with Metasploit, allowing the use of customizable command payloads. The exploit does not require authentication and has been tested successfully on the specified ESVA version. The repository is structured as a typical Metasploit exploit module, with all logic contained in a single Ruby file. The main attack vector is network-based, targeting a web-exposed CGI script. The module is weaponized, supporting arbitrary command execution through the Metasploit payload system.

Disclosed Aug 16, 2012rubynetwork

ACTIVITY FEED

Recent activity

5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

5 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5