CVE-2020-15591
📋 TL;DR
CVE-2020-15591 is an eval injection vulnerability in F*EX's fexsrv component that allows unauthenticated remote code execution. Attackers can execute arbitrary code on vulnerable F*EX servers by injecting malicious input. This affects all F*EX installations running versions before fex-20160919_2.
💻 Affected Systems
- F*EX (Frams' Fast File EXchange)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining root privileges, data exfiltration, installation of persistent backdoors, and lateral movement within the network.
Likely Case
Unauthenticated remote code execution leading to web server compromise, data theft, and potential ransomware deployment.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are applied, though RCE would still be possible.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: fex-20160919_2 and later
Vendor Advisory: https://fex.rus.uni-stuttgart.de
Restart Required: Yes
Instructions:
1. Download latest F*EX version from official site
2. Stop F*EX service
3. Apply update
4. Restart F*EX service
5. Verify version is fex-20160919_2 or newer
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to F*EX service using firewall rules
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Service Disablement
linuxTemporarily disable F*EX service until patched
systemctl stop fex
systemctl disable fex
🧯 If You Can't Patch
- Isolate vulnerable system in separate network segment with strict firewall rules
- Implement web application firewall (WAF) with eval injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check F*EX version and compare with vulnerable versions. If version is older than fex-20160919_2, system is vulnerable.Check Version:
fex --version or check F*EX configuration files for version informationVerify Fix Applied:
Verify F*EX version is fex-20160919_2 or newer and test eval injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual eval() or system() calls in F*EX logs
- Suspicious file upload patterns
- Unexpected process execution from web user context
Network Indicators:
- HTTP requests containing eval injection patterns to F*EX endpoints
- Outbound connections from F*EX server to unknown IPs
SIEM Query:
source="fex.log" AND (eval OR system OR exec) AND status=200