CriticalPublic exploit

Unauthenticated Remote Code Execution in dnaLIMS sysAdmin.cgi

IdentifiersCVE-2017-6526CWE-306

CVE-2017-6526 is a critical vulnerability in dnaTools dnaLIMS version 4-2015s13, where the administrative web shell (cgi-bin/dna/sysAdmin.cgi) is improperly protected, allowing unauthenticated attackers to execute arbitrary commands on the host system via crafted POST requests. The flaw is due to a lack of authentication and access control on the sysAdmin.cgi endpoint, exposing full administrative functionality to any remote user.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary system commands with the privileges of the web server process, leading to full compromise of the dnaLIMS application and potentially the underlying operating system. This can result in data theft, system manipulation, lateral movement, and persistent compromise, especially if the application is internet-accessible.

Mitigation

If you can’t patch tonight, do this now.

Isolate dnaLIMS from the internet and untrusted networks using network segmentation and firewall rules. Restrict access to the application to only trusted users and hosts. Monitor for signs of compromise and consider migrating to a supported and secure alternative, as the vendor has not addressed the vulnerability.

Remediation

Patch, then assume compromise.

No official patch or remediation was provided by the vendor. The only vendor recommendation was to place the application behind a firewall. Organizations should immediately remove dnaLIMS from public or DMZ access, restrict access to trusted internal networks, and consider replacing the software due to the vendor's lack of response and ongoing risk.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

dnalims_admin_exec.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/linux/http/dnalims_admin_exec.rb) targeting dnaLIMS, a laboratory information management system. The exploit leverages an unauthenticated administrative endpoint (/cgi-bin/dna/sysAdmin.cgi) that allows arbitrary command execution via POST requests. The module provides both a check method (to verify vulnerability by executing 'perl -V') and an exploit method (to execute arbitrary payloads). The exploit is operational, allowing remote attackers to execute commands as the web server user, provided the endpoint is accessible and Perl is installed on the target. The code is written in Ruby and is structured as a standard Metasploit exploit module.

Disclosed Mar 8, 2017rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

DnatoolsDnalimsapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2017-6526

NVD

nvd.nist.gov/vuln/detail/CVE-2017-6526

MITRE CWE · CWE-306

cwe.mitre.org

Third Party Advisory

shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims

securityfocus.com

securityfocus.com/bid/96823

exploit-db.com

exploit-db.com/exploits/41578

Unauthenticated Remote Code Execution in dnaLIMS sysAdmin.cgi

IdentifiersCVE-2017-6526CWE-306