logo_clicknbuy.png

CVE-2011-10007 – Apache::FileFind::Rule Arbitrary Code Execution Vulnerability

The following table lists the changes that have been made to the
CVE-2011-10007 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 9b29abf9-4ab0-4765-b253-1875cd9b441e

    Jun. 05, 2025

    Action Type Old Value New Value
    Added Description File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename.

    A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed.

    Example:

    $ mkdir /tmp/poc; echo > “/tmp/poc/|id”
    $ perl -MFile::Find::Rule
        -E ‘File::Find::Rule->grep(“foo”)->in(“/tmp/poc”)’
    uid=1000(user) gid=1000(user) groups=1000(user),100(users)
    Added CWE CWE-78
    Added Reference https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch
    Added Reference https://github.com/richardc/perl-file-find-rule/pull/4
    Added Reference https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
    Added Reference https://rt.cpan.org/Public/Bug/Display.html?id=64504
Share the Post:

Related Posts