SB2020031608 - Multiple vulnerabilities in rConfig
Published: March 16, 2020 Updated: May 19, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) OS Command Injection (CVE-ID: CVE-2019-19509)
The vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to absent filtration of user-supplied data passed to ajaxArchiveFiles.php script. A remote authenticated user can send a specially crafted HTTP GET request to the affected script and execute arbitrary OS commands on the target system.
2) SQL injection (CVE-ID: CVE-2020-10220)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the commands.inc.php searchColumn parameter. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
3) Session Fixation (CVE-ID: CVE-2020-12258)
The vulnerability allows a remote attacker to gain access to sensitive information on the system.
The vulnerability exists due to session expiry and randomization are mishandled. A remote attacker can reuse a session via PHPSESSID.
Note: This vulnerability is exploitable in conjunction with CVE-2020-12256 or CVE-2020-12259.
4) Arbitrary file upload (CVE-ID: CVE-2020-12255)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload in the "vendor.crud.php". A remote attacker can upload a malicious file and execute it on the server.
5) Cross-site scripting (CVE-ID: CVE-2020-12259)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "rid" GET parameter in the "configDevice.php" file. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Cross-site scripting (CVE-ID: CVE-2020-12256)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "deviceId" GET parameter in the "devicemgmnt.php" file. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
7) Cross-site request forgery (CVE-ID: CVE-2020-12257)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as leverage this vulnerability by creating a form (add a user, delete a user, or edit a user).
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.
References
- http://packetstormsecurity.com/files/156146/rConfig-3.9.3-Remote-Code-Execution.html
- https://github.com/v1k1ngfr
- https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py
- https://raw.githubusercontent.com/v1k1ngfr/exploits/master/rconfig_exploit.py?token=
- http://packetstormsecurity.com/files/156688/rConfig-3.9-SQL-Injection.html
- https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_sqli.py
- https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
- https://gist.github.com/farid007/9f6ad063645d5b1550298c8b9ae953ff
- https://gist.github.com/farid007/eb7310749520fb8cdf5942573c9954ef