Solar-Log 500 2.8.2 - Incorrect Access Control
ID: solar-log-authbypass
Severity: high
Author: geeknik
Tags: solarlog,auth-bypass,edb
Description
Section titled “Description”Solar-Log 500 2.8.2 is susceptible to incorrect access control because the web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server.
YAML Source
Section titled “YAML Source”id: solar-log-authbypass
info: name: Solar-Log 500 2.8.2 - Incorrect Access Control author: geeknik severity: high description: Solar-Log 500 2.8.2 is susceptible to incorrect access control because the web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication, which allows arbitrary remote attackers gain administrative privileges by connecting to the server. reference: - https://www.exploit-db.com/exploits/49986 classification: cwe-id: CWE-284 metadata: max-request: 1 tags: solarlog,auth-bypass,edb
http: - method: GET path: - "{{BaseURL}}/lan.html"
matchers-condition: and matchers: - type: status status: - 200
- type: word part: header words: - "IPC@CHIP"
- type: word part: body words: - " Solare Datensysteme GmbH" condition: and# digest: 4a0a004730450220291ee7daba72f925eb495530d08ef54c98927bf8b54e39f013a3c409a896ecf902210087350f05a2de1af214f0feb3cb6f80d62e681853558025eeb03bbb4d4ad8fb02:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/vulnerabilities/other/solar-log-authbypass.yaml"