CriticalPublic exploit

Unauthenticated Arbitrary File Upload to SYSTEM RCE in MiniWeb HTTP Server <= Build 300

IdentifiersCVE-2013-10047CWE-434· Unrestricted Upload of File with…

CVE-2013-10047 is an unrestricted file upload vulnerability in MiniWeb HTTP Server up to and including Build 300. The vulnerable upload functionality does not adequately restrict uploaded file types or destination paths, allowing an unauthenticated remote attacker to upload arbitrary files to the server filesystem. By supplying a crafted path traversal sequence through the upload handler, an attacker can write a malicious executable into the Windows system32 directory and then upload a corresponding .mof file into the Windows Management Instrumentation (WMI) repository directory. On affected pre-Vista Windows systems, processing of the .mof file by WMI causes the uploaded payload to be executed with SYSTEM privileges, resulting in full remote code execution on the host.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to unauthenticated remote code execution as NT AUTHORITY\SYSTEM on the target host. Because the attacker can write arbitrary files to sensitive filesystem locations and trigger execution through WMI MOF processing, the vulnerability can enable complete host compromise, including installation of malware, persistence, privilege escalation to the highest local privilege level, data theft, tampering, and use of the system as a pivot point for further intrusion.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to MiniWeb HTTP Server so that untrusted users cannot reach the upload endpoint. Disable or remove file upload functionality where not strictly required. Run the service with minimal filesystem permissions and ensure it cannot write to Windows system directories or WMI-related paths. Monitor for unexpected file creation in system32 and WMI repository locations, especially .exe and .mof files. On legacy systems, disable or tightly control WMI MOF auto-processing where operationally feasible. Because the exploit is only viable on Windows versions prior to Vista, migrating affected hosts to supported Windows versions materially reduces exposure.

Remediation

Patch, then assume compromise.

Upgrade MiniWeb HTTP Server to a version that removes or properly restricts the vulnerable upload functionality. The upload handler should enforce strict server-side validation of file types, reject executable and script content, prevent path traversal, and constrain writes to a dedicated non-system upload directory with least-privilege permissions. Systems running unsupported MiniWeb builds on legacy Windows platforms should be retired or replaced. If an immediate software fix is not available, disable the upload feature or remove external access to the service until remediation is complete.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

miniweb_upload_wbem.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (miniweb_upload_wbem.rb) that exploits a file upload vulnerability in MiniWeb HTTP server build 300 on Windows (pre-Vista). The exploit works by uploading a custom Windows executable payload to the target's system32 directory, then uploading a malicious MOF file to the wbem/mof directory. The MOF file triggers the Windows Management Instrumentation (WMI) service to execute the uploaded payload, resulting in remote code execution with SYSTEM privileges. The module is operational and leverages Metasploit's payload generation and HTTP client capabilities. The attack vector is network-based, targeting the MiniWeb server over HTTP (default port 8000). The module also includes cleanup routines to remove uploaded files. The exploit targets CVE-2013-10047 and is effective against MiniWeb build 300 on Windows XP and similar systems.

Disclosed Apr 9, 2013rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Miniweb Http ServerMiniweb Http Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3