CVE-2003-0050: Apple Streaming Server CGI shell metacharacter code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with a high EPSS score, though the product is legacy and no KEV listing or confirmed public exploit is present.

What it is

parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 passes input to a shell without sanitizing shell metacharacters, allowing command injection. A remote attacker can therefore run arbitrary commands on the server, which is a serious exposure for an internet-facing streaming host.

Impact

An attacker gains remote code execution with the privileges of the web server process, enabling full compromise of the streaming server host. This can lead to data theft, service disruption, or use of the host as a pivot into the network.

Attack surface

The flaw is reachable over the network through the parse_xml.cgi endpoint of the administration server, per the AV:N vector. The CVSS vector shows Au:N, so no authentication is required, and no user interaction is indicated.

Exploitation

The record is not listed in CISA KEV and no ransomware use is documented, but EPSS is high at roughly 0.69 (99th percentile), suggesting elevated likelihood of exploitation activity. Reference tags are limited to a vendor advisory, so no public exploit confirmation is provided.

What to do

• Apply the Apple security update referenced in the vendor advisory for the affected Streaming Server versions.
• If the streaming administration interface is not needed, disable or remove parse_xml.cgi and the admin service.
• Restrict network access to the administration server to trusted management hosts only.
• Run the streaming service under a low-privilege account to limit the impact of command execution.
• Monitor for and block shell metacharacter patterns in requests to CGI endpoints.

Detection

• Inspect web and CGI logs for requests to parse_xml.cgi containing shell metacharacters such as ;, |, `, $(), or &&.
• Alert on unexpected child processes spawned by the web server or streaming service user.
• Monitor for outbound connections or file writes originating from the streaming server process.
• Review host process accounting for shell interpreters launched by the CGI handler.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.