Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure

ID: CVE-2022-34534

Severity: high

Author: ritikchaddha

Tags: cve,cve2022,digital-watchdog,dw,spectrum,exposure

Description

Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.

YAML Source

id: CVE-2022-34534

info:
  name: Digital Watchdog DW Spectrum Server 4.2.0.32842 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
  reference:
    - https://gist.github.com/secgrant/820faeeaa0cb4889edaa1d6fef83deab
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34534
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-34534
    cwe-id: CWE-200
    epss-score: 0.0015
    epss-percentile: 0.51136
    cpe: cpe:2.3:o:dw:spectrum_server_firmware:4.2.0.32842:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: dw
    product: spectrum_server_firmware
    shodan-query:
      - http.favicon.hash:868509217
      - http.favicon.hash:"868509217"
    fofa-query: icon_hash="868509217"
  tags: cve,cve2022,digital-watchdog,dw,spectrum,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/moduleInformation"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "name\":", "cloudHost\":", "remoteAddresses")'
          - 'contains(header, "application/json")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100910859024b6293bc5fc26cb0c884ea2759873e1271f4a36f0fa236aa313bf2e802200d8b8e59ca2d20d63a0e4d5bd178b76db62ba68bcd87a811395ef8b9037088db:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-34534.yaml"

View on Github