CVE-2019-17270
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on Yachtcontrol webservers via a crafted HTTP request to the systemcall.php endpoint. It affects Yachtcontrol systems exposed to the internet through Dutch mobile IP ranges. The vulnerability enables complete system compromise.
💻 Affected Systems
- Yachtcontrol
📦 What is this software?
Yachtcontrol by Yachtcontrol
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing installation of persistent backdoors, data theft, lateral movement to other systems, and disruption of yacht control systems.
Likely Case
Attackers gain shell access to execute arbitrary commands, potentially installing cryptocurrency miners, creating botnet nodes, or stealing sensitive data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated yacht control system only.
🎯 Exploit Status
Simple HTTP GET request with command injection, multiple public exploit scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Remove or restrict access to systemcall.php file.
🔧 Temporary Workarounds
Remove vulnerable endpoint
linuxDelete or rename the systemcall.php file to prevent exploitation
rm /path/to/yachtcontrol/pages/systemcall.php
mv /path/to/yachtcontrol/pages/systemcall.php /path/to/yachtcontrol/pages/systemcall.php.disabled
Restrict access with web server rules
allBlock access to systemcall.php using web server configuration
# Apache: <Location "/pages/systemcall.php">
Order deny,allow
Deny from all
</Location>
# Nginx: location ~ /pages/systemcall\.php$ { return 403; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate yacht control systems from other networks
- Deploy web application firewall (WAF) with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://target/pages/systemcall.php?command=id' - if it returns system user information, it's vulnerableCheck Version:
Check Yachtcontrol version files or documentation - no standard command availableVerify Fix Applied:
Attempt the same curl command - should return 403/404 error or no command output📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /pages/systemcall.php with command parameter
- Unusual system commands executed from web server process
Network Indicators:
- HTTP GET requests containing system commands in URL parameters
- Traffic from unexpected sources to yacht control systems
SIEM Query:
source="web_server_logs" AND uri="/pages/systemcall.php" AND query="command=*"