CVE-2011-2195
📋 TL;DR
CVE-2011-2195 is a critical remote code execution vulnerability in WebSVN 2.3.2 that allows unauthenticated attackers to execute arbitrary commands on the underlying operating system. This affects WebSVN installations where the 'allowDownload' option is enabled in config.php. Attackers can exploit this by crafting malicious requests to the dl.php script.
💻 Affected Systems
- WebSVN
📦 What is this software?
Websvn by Websvn
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, install malware, exfiltrate data, or pivot to other systems.
Likely Case
Remote code execution leading to web server compromise, data theft, or deployment of web shells for persistent access.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though the vulnerability still exists.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attackers only need to craft a specific URL with the 'path' parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WebSVN 2.3.3 and later
Vendor Advisory: https://websvn.tigris.org/issues/show_bug.cgi?id=219
Restart Required: No
Instructions:
1. Upgrade to WebSVN 2.3.3 or later. 2. Download from official WebSVN repository. 3. Replace existing installation files. 4. No service restart required as it's a PHP application.
🔧 Temporary Workarounds
Disable allowDownload option
allSet allowDownload to false in config.php to prevent exploitation
Edit config.php and set: $config->setAllowDownload(false);
Restrict access to dl.php
allBlock direct access to the vulnerable dl.php script using web server configuration
For Apache: <Location /dl.php> Order deny,allow Deny from all </Location>
For Nginx: location = /dl.php { deny all; }
🧯 If You Can't Patch
- Disable the 'allowDownload' option in config.php immediately
- Implement network segmentation to isolate WebSVN server from critical systems
- Add web application firewall rules to block requests to dl.php with suspicious path parameters
🔍 How to Verify
Check if Vulnerable:
Check config.php for $config->setAllowDownload(true); and verify WebSVN version is 2.3.2Check Version:
Check the version in the WebSVN footer or examine the source code files for version markersVerify Fix Applied:
Verify WebSVN version is 2.3.3 or later and ensure allowDownload is disabled or properly sanitized📡 Detection & Monitoring
Log Indicators:
- HTTP requests to dl.php with unusual path parameters
- Commands being executed via web server process
- Unusual process creation from web server user
Network Indicators:
- HTTP requests containing shell metacharacters in path parameter
- Outbound connections from web server to unexpected destinations
SIEM Query:
source="webserver.log" AND (uri="/dl.php" AND (path CONTAINS "|" OR path CONTAINS ";" OR path CONTAINS "`"))