exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Takeshi Shiomitsu

Cisco Small Business RV Series Authentication Bypass / Command Injection

Posted Feb 1, 2022

Authored by jbaines-r7, Takeshi Shiomitsu | Site metasploit.com

This Metasploit module exploits an authentication bypass (CVE-2021-1472) and command injection (CVE-2021-1473) in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the upload.cgi binary will use the contents of the HTTP Cookie field as part of a curl request aimed at an internal endpoint. The curl request is executed using popen and allows the attacker to inject commands via the Cookie field. A remote and unauthenticated attacker using this module is able to achieve code execution as www-data. This module affects the RV340, RV340w, RV345, and RV345P using firmware versions 1.0.03.20 and below.

tags | exploit, remote, web, cgi, code execution

systems | cisco

advisories | CVE-2021-1472, CVE-2021-1473

SHA-256 | d5c273af97dd2e97fb770967821e9b90847b04e11e1abb75510669721ee38b45

Download | Favorite | View