RG-UAC Ruijie - Password Hashes Leak

ID: ruijie-password-leak

Severity: high

Author: ritikchaddha,galoget

Tags: password,leak,ruijie,exposure,firewall,router

Description

Multiple Firewall Devices from vendor Ruijie Networks are affected by an information leakage vulnerability where credentials are included in the source code of the web admin login interface (usernames, roles, MD5 hashes and additional details of each user). Attackers can use this information to illegally access into the vulnerable devices, obtain sensitive device information and change configurations. The vulnerability is identified by CNVD-2021-14536.

YAML Source

id: ruijie-password-leak

info:
  name: RG-UAC Ruijie - Password Hashes Leak
  author: ritikchaddha,galoget
  severity: high
  description: |
    Multiple Firewall Devices from vendor Ruijie Networks are affected by an information leakage vulnerability where credentials are included in the source code of the web admin login interface (usernames, roles, MD5 hashes and additional details of each user). Attackers can use this information to illegally access into the vulnerable devices, obtain sensitive device information and change configurations. The vulnerability is identified by CNVD-2021-14536.
  reference:
    - https://forum.butian.net/share/177
    - https://www.ruijie.com.cn/gy/xw-aqtg-zw/86924/
    - https://www.cnvd.org.cn/flaw/show/CNVD-2021-14536
  classification:
    cpe: cpe:2.3:o:ruijie:rg-uac_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ruijie
    product: rg-uac_firmware
    shodan-query: http.html:"Get_Verify_Info"
  tags: password,leak,ruijie,exposure,firewall,router

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), ''\"role\":\"super_admin\"'')'
          - 'contains(tolower(body), ''\"role\":\"guest_admin\"'')'
          - 'contains(tolower(body), ''\"role\":\"reporter_admin\"'')'
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        regex:
          - '"password":"[a-f0-9]{32}'
# digest: 4a0a00473045022045ec2e61455a9cdb08eb9be5175fae332c061adfe8826e56748f51b1ded89ae7022100a58c69a0bde7dbe1f40d12904135769ee2e884093e4bd076b0639f2db5465dac:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/ruijie/ruijie-password-leak.yaml"

View on Github