$ cve CVE-2009-2936 JSON

CVE-2009-2936 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 63.8% (pctl 99)

Patch early

A public exploit exists.

Description

The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	63.82% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-287
On CISA KEV	no
Public exploit	yes
Published	2010-04-05
Last modified	2026-06-16

Affected (1)

Vendor	Product
varnish.projects.linpro	varnish

Public exploits

Source	Title	Date
exploit-db	Varnish Cache CLI Interface - Remote Code Execution (Metasploit)	2014-12-19

References

→ the Explorer · watch your stack · NVD