CVE-2021-28940
📋 TL;DR
CVE-2021-28940 is a command injection vulnerability in MagpieRSS 0.72 that allows remote attackers to execute arbitrary commands on affected systems. The vulnerability exists in the Snoopy.class.inc file where improper escaping of curl commands enables injection. This affects any system running vulnerable MagpieRSS versions with the debug or simple scripts accessible.
💻 Affected Systems
- MagpieRSS
📦 What is this software?
Magpierss by Magpierss Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level command execution, data exfiltration, and persistent backdoor installation.
Likely Case
Remote code execution leading to web server compromise, data theft, and lateral movement within the network.
If Mitigated
Limited impact if scripts are disabled or proper input validation is implemented.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.72 and later versions with proper escaping
Vendor Advisory: https://github.com/kellan/magpierss/commit/04d2a88b97fdba5813d01dc0d56c772d97360bb5
Restart Required: No
Instructions:
1. Update to latest MagpieRSS version. 2. Apply the patch from GitHub commit 04d2a88b. 3. Replace vulnerable Snoopy.class.inc file with patched version.
🔧 Temporary Workarounds
Disable vulnerable scripts
allRemove or restrict access to magpie_debug.php and magpie_simple.php scripts
rm /path/to/magpierss/scripts/magpie_debug.php
rm /path/to/magpierss/scripts/magpie_simple.php
Web server access control
allBlock access to vulnerable scripts via web server configuration
# Apache: <Location "/scripts/magpie_*"> Require all denied </Location>
# Nginx: location ~ /scripts/magpie_* { deny all; }
🧯 If You Can't Patch
- Implement strict input validation and sanitization for RSS URL parameters
- Deploy WAF rules to block command injection patterns in URL parameters
🔍 How to Verify
Check if Vulnerable:
Check if MagpieRSS version is 0.72 and if /scripts/magpie_debug.php or /scripts/magpie_simple.php are accessibleCheck Version:
grep -r 'MagpieRSS' /path/to/installation/ | grep 'version'Verify Fix Applied:
Verify Snoopy.class.inc file contains proper escaping in curl command execution (line 660+)📡 Detection & Monitoring
Log Indicators:
- Unusual curl command executions with pipe characters or semicolons
- Access to magpie_debug.php or magpie_simple.php with suspicious URL parameters
Network Indicators:
- HTTP requests to vulnerable scripts containing command injection patterns
SIEM Query:
source="web_logs" AND (uri="/scripts/magpie_debug.php" OR uri="/scripts/magpie_simple.php") AND (url="*;*" OR url="*|*" OR url="*`*")🔗 References
- https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
- https://pastebin.com/kpzHKKJu
- https://www.exploit-db.com/exploits/49643
- https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
- https://pastebin.com/kpzHKKJu
- https://www.exploit-db.com/exploits/49643
